From owner-freebsd-net@freebsd.org Tue Apr 6 17:24:41 2021 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 8D9025B1122; Tue, 6 Apr 2021 17:24:41 +0000 (UTC) (envelope-from Michael.Tuexen@lurchi.franken.de) Received: from drew.franken.de (mail-n.franken.de [193.175.24.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Sectigo RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FFDt041RWz3vFP; Tue, 6 Apr 2021 17:24:40 +0000 (UTC) (envelope-from Michael.Tuexen@lurchi.franken.de) Received: from [IPv6:2a02:8109:1140:c3d:bc46:6e0e:6903:1acf] (unknown [IPv6:2a02:8109:1140:c3d:bc46:6e0e:6903:1acf]) (Authenticated sender: lurchi) by drew.franken.de (Postfix) with ESMTPSA id 0544E789BA500; Tue, 6 Apr 2021 19:24:36 +0200 (CEST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\)) Subject: Re: TCP Connection hang - MSS again From: Michael Tuexen In-Reply-To: <202104061702.136H2hZh006398@gndrsh.dnsmgr.net> Date: Tue, 6 Apr 2021 19:24:35 +0200 Cc: Eugene Grosbein , freebsd-net , freebsd-current@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <202104061702.136H2hZh006398@gndrsh.dnsmgr.net> To: "Rodney W. Grimes" X-Mailer: Apple Mail (2.3654.60.0.2.21) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Rspamd-Queue-Id: 4FFDt041RWz3vFP X-Spamd-Bar: ++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of Michael.Tuexen@lurchi.franken.de has no SPF policy when checking 193.175.24.27) smtp.mailfrom=Michael.Tuexen@lurchi.franken.de X-Spamd-Result: default: False [2.30 / 15.00]; RCVD_TLS_ALL(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; MV_CASE(0.50)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[franken.de]; ARC_NA(0.00)[]; TO_DN_SOME(0.00)[]; NEURAL_SPAM_MEDIUM(1.00)[1.000]; SPAMHAUS_ZRD(0.00)[193.175.24.27:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[193.175.24.27:from]; AUTH_NA(1.00)[]; NEURAL_SPAM_SHORT(1.00)[1.000]; R_SPF_NA(0.00)[no SPF record]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:680, ipnet:193.174.0.0/15, country:DE]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-current,freebsd-net]; RCVD_IN_DNSWL_LOW(-0.10)[193.175.24.27:from] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Apr 2021 17:24:41 -0000 > On 6. Apr 2021, at 19:02, Rodney W. Grimes = wrote: >=20 >> 06.04.2021 19:54, Rodney W. Grimes wrote: >>>> 05.04.2021 19:44, Rozhuk Ivan wrote: >>>>=20 >>>>>>> As I understand, in some cases remote host does not reply with = MSS >>>>>>> option, and host behind router continue use mss 8960, that = dropped >>>>>>> by router. =20 >>>>>> If the peer does not provide an MSS option, your local FreeBSD = based >>>>>> host should use an MSS of net.inet.tcp.mssdflt bytes. The default = is >>>>>> 536. So I don't think this should be a problem. >>>>>=20 >>>>> Thats it! >>>>> Thanks, it was ~64k in mine config. >>>>=20 >>>> This is also per-host setting, you know :-) >>>>=20 >>>> It is generally bad idea using MTU over 1500 for an interface = facing public network >>>> without -mtu 1500. You see, because TCP MSS affects only TCP and = there is also UDP >>>> that happily produces oversized datagramms for DNS or RTP or NFS or = tunneling like L2TP or OpenVPN etc. >>>> relying on IP fragmentation. >>>>=20 >>>> I still recommend using -mtu 1500 in addition to mssdflt in your = case. >>>=20 >>> I do not recommend such a setting. That would defeat any jumbo = frame usage >>> locally! >>=20 >> Why? Default route should not be used for local delivery. >=20 > Your right, but we are both making assumptions, I assumed that most > likely the only route on the system is the default route, and your > assuming that they are running with something more than a default > route. >=20 >>> The gateway/router that is forwarding packets to the internet = connection >>> needs its upstream interface mtu set properly, and configured to = properly >>> return icmp need fragement messages on the interfaces towards the >>> internal network. >>=20 >> This results in extra delays and retransmission during outgoing data = transfer, not good. >> The mechanics is much more fragile than default route's mtu = attribute. >=20 > The delay should be pretty slight, the router is going to return an > icmp message, and if configured to do so frag the packets and > forward them on, no retransmission would occur as the DF flag > is not normally set unless explicitly requested. 1. Isn't a router either fragmenting a packet and forwarding the fragments or sending back an ICMP packet and dropping the packet? 2. Isn't FreeBSDs TCP implementation setting the DF bit, if net.inet.tcp.path_mtu_discovery is set to 1, which is the default. So it would take one RTT to the router For TCP to react and reduce the = MSS. Best regards Michael >=20 > It still makes no since to me to increase the interface MTU and then > crank it back down by using a route MTU. You might as well just leave > the MTU alone and not have 2 configurations items more or less doing > nothing. >=20 > --=20 > Rod Grimes = rgrimes@freebsd.org > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"