On Thu, 2012-05-31 at 15:58 +0200, Bernhard Schmidt wrote: > > I saw this issue specifically with IPv6 transport, so we always have DF > bit set. I did not do much further debugging. Problem is that the tunnel > is configured with MTU 1406, but 1406 bytes don't really get across. At > least not from server to the client, the other direction seems to work > well. I guess the client stack is perfectly fine with pMTU discovery and > having to fragment it. I will debug this further. Would be interesting to see this on the wire between client and server. The server *ought* to be receiving 'too big' ICMP responses, and reducing its idea of the MTU automatically. Hm, that's a trick we probably need to do locally. Although when running as non-root, adjusting the MTU dynamically is hard. I wonder if DTLS allows us to fragment DTLS records over more than one UDP packet? And I wonder if our version of OpenSSL is *automatically* doing that for us, while Cisco's is not? That would explain the asymmetry. -- dwmw2 -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 6171 bytes Desc: not available URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20120531/b678211d/attachment-0001.bin>
