摘要： “路径MTU探测”是IPv6的一个非常重要的特征。IPv6分组不能被中介路由器分割。源主机必须知道通往目标主机通路上的最小MTU。为此源主机必须使用MTU探测,也就是用ICMPv6的“包太大”报文来发现MTU。如果防火墙挡住ICMPv6包的话,将导致MTU探测无法正确执行。这需要防火墙可以识别出与连接有关的ICMPv6信息。该文提出了一种方法可以解决这个问题,并对相关的安全问题进行了探讨。

关键词: 堡垒主机, 路径最大传输单元, 最大传输单元, “包太大”报文

Abstract: Path MTU discovery is a very important characteristic of IP version 6.The IPv6 packages can’t be splited by the routes in the path, sothe source host must know the minimum MTU. Path MTU discovery is used by the source host to know the minimum MTU of a path, which meanspacket too big messages is used. If firewall block packet too big messages, path MTU discovery couldn’t work. So firewall should distinguish theinformation of ICMPv6 message associated with a path. The paper puts forward a method to resolve the issue, and discusses the security problemabout it.

中图分类号: 

• TP393.08