Subject: [eap] Question on Framed-MTU attribute

From: [email-masked] (Bernard Aboba)
Date: Mon, 7 Jul 2003 11:35:55 -0700 (PDT)

In response to the question, we got back a number of responses noting that
the maximum size of the EAP packet that can be sent by a RADIUS server is
given by Framed-MTU - 4.

Since Framed-MTU denotes the maximum size of an IP packet that can be
transmitted over the wire between the Supplicant and the Authenticator,
any additional overhead beyond that required for an IP packet needs to be
taken into account.

For example, in IEEE 802.1X, there are 4 octets of additional overhead
beyond what might be required for an IP packet -- the 802.1X Version (1),
Type(1) and Body Length(2) fields.

In PPP, there are also 4 octets of additional overhead, namely the
Type (1), Length (1) and Authentication-Protocol (2) fields of the
Authentication-Protocol Configuration Option format defined in [RFC 1661].

Here is what draft-congdon says about the Framed-MTU attribute:

"This attribute indicates the maximum size of an IP packet
that may be transmitted over the wire between the Supplicant
and the Authenticator.

IEEE 802.1X Authenticators set this to the value
corresponding to the relevant 802 medium, and include
it in the RADIUS Access-Request. For EAP over IEEE 802 media,
the Framed-MTU values (which do not include
LLC/SNAP overhead) and maximum frame length
values (not including the preamble) are as follows:

.nf
                                     Maximum Frame
Media             Framed-MTU            Length
=========        ===============     ==============
Ethernet              1500              1522
802.3                 1500              1522
802.4                 8174              8193
802.5 (4 Mbps)        4528              4550
802.5 (16 Mbps)      18173             18200
802.5 (100 Mb/s)     18173             18200
802.6                 9191              9240
802.9a                1500              1518
802.11                2304              2346
802.12 (Ethernet)     1500              1518
802.12 (Token Ring)   4502              4528
FDDI                  4479              4500"

I am thinking that the need to subtract out 4 octets should probably be
included in the above paragraph.