Subject: Question on "identification" field of IP header

From: Ramesh Shankar <[email-masked]>
Date: Fri, 13 Dec 2002 07:49:36 -0700

If the "Don't fragment bit" is set in the IP header, what purpose does 
the "identification" field serve? Why can't I simply put 0 for this 
field in such a case? I remember coming across some e-mail chain in one 
of the mailing lists (TCP-IMPL, e2e, TSVWG) about this issue and the 
interaction with NAT. But I am not sure what came out of that discussion.

Also, some of the "OS fingerprinting" techniques in the networking world 
apparently use the IP ID field to identify various operating systems. 
Apparently some operating systems (or protocol stacks, if you prefer) 
don't increment this by 1. Why would anyone want to do this? Wouldn't 
this cause possibles issues wrt to wrap around in the possible case of 
fragmentation? One could always argue that with high speed Ethernet, 
that anyway would be a possibility, but I would like to understand the 
reason behind such a case.

Thanks for your time,

S.R.

---

From: der Mouse <[email-masked]>
Date: Fri, 13 Dec 2002 16:41:51 +0100 (CET)

> If the "Don't fragment bit" is set in the IP header, what purpose
> does the "identification" field serve?

It says which datagram is affected if an ICMP is returned in resposne
to it, if nothing else.

> I remember coming across some e-mail chain in one of the mailing
> lists (TCP-IMPL, e2e, TSVWG) about this issue and the interaction
> with NAT.

Heh.  My usual response to "NAT interacts badly with <foo>" is "don't
use NAT, then".  It just breaks too many of the assumptions underlying
IP-based networking.  But it wouldn't surprise me a bit if there were
NAT implementations broken enough to assume that packets with identical
IDs arriving within a small enough temporal window of one another were
actually the same packet.

Note that the portion of a packet returned in an ICMP does not include
even the IP source and destination addresses; the identification value
is almost the only value that can be relied upon to identify the
original packet upon getting an ICMP....

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Alan Cox <[email-masked]>
Date: 13 Dec 2002 17:21:18 +0000

> field in such a case? I remember coming across some e-mail chain in one 

Linux does this in some situations. At high speed it becomes a real
issue because the ip id reuse time is way way lower than the amount of
time fragments get lost in the network  Checksums should help avoid this
but they are not very strong