netdev - Re: linux bridge and MTU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Oct 2008 08:26:10 -0700
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Michael Tokarev <mjt@....msk.ru>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: linux bridge and MTU

On Wed, 29 Oct 2008 16:24:51 +0300
Michael Tokarev <mjt@....msk.ru> wrote:

> There's an interesting interaction between different
> MTU (max transmission unit) values on interfaces
> which are bridged together.  I'm trying to understand
> how it works.
> 
> Suppose there are 2 interfaces in the bridge, one is
> with standard 1500 mtu and another is, say 3500.
> 
> As far as I can see, bridge interface sets its mtu to
> be the smallest of all the components.  Which seems
> to be the right ting to do.
> 
> But now the question is - is it possible to communicate
> over the interface with larger MTU using full frames?
> 
> For example, here are a tcpdump from a single ping-pong
> "pair" between host "B" which is connected to a larger-MTU
> interface, and host "A" which is with the bridge described
> above, using 3000-byte packets:
> 
> IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 3028) B > A ICMP echo request, id 35331, seq 2, length 3008
> 
> IP (tos 0x0, ttl 64, id 39747, offset 0, flags [+], proto ICMP (1), length 1500) B > A: ICMP echo reply, id 35331, seq 2, length 1480
> IP (tos 0x0, ttl 64, id 39747, offset 1480, flags [+], proto ICMP (1), length 1500) B > A: icmp
> IP (tos 0x0, ttl 64, id 39747, offset 2960, flags [none], proto ICMP (1), length 68) B > A: icmp
> 
> So, the reply comes in 3 packets according to 1500 MTU of
> the bridge interface.
> 
> When forwarding from B to some host C connected to the other
> interface with standard 1500 mtu, host A correctly sends
> "fragmentation required" ICMP back, so that part works.
> Also, host A obviously is able to receive larger frames.
> But it can't SEND larger frames, even if the underlying
> interface has proper MTU settings?
> 
> Is there a way to achieve this?
> 

The bridge is a pure level 2 switch. It tries to conform to the 802.1d standard
and therefore is agnostic of higher level protocols. To quote spec

---------------------

6.3.8 Maximum Service Data Unit Size
The Maximum Service Data Unit Size that can be supported by an IEEE 802 LAN varies with the MAC
method and its associated parameters (speed, electrical characteristics, etc.). It may be constrained by the
owner of the LAN. The Maximum Service Data Unit Size supported by a Bridge between two LANs is the
smaller of that supported by the LANs. No attempt is made by a Bridge to relay a frame to a LAN that does
not support the size of Service Data Unit conveyed by that frame.

---------------------
You might be able to do something with netfilter.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html