cancel
Showing results for 
Search instead for 
Did you mean: 

ipv6 sloooow tonight

MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

Quote from: AndyH
The MTU stuff is a little bit beyond me also  Cool

I might able to shed some light on it!
Quote
A 1492 byte IP packet (1492 = 1444 bytes + 40 bytes +  8 bytes) works fine over v6

Okay. That's good.
Quote
Anything above 1492 bytes fails

This to be expected. As you've said, the MTU for PPPoE is 1492.
Quote
On v4, I can send any size.

You can, but only because your router is is splitting the packet up, i.e. fragmenting it, in order to allow it to traverse the PPPoE link.
Tell ping to set the 'do not fragment' bit and you'll see a different story:
$ ping -s 9999 -c 5 ipv4.thinkbroadband.com -M do
PING ipv4.thinkbroadband.com (80.249.99.130) 9999(10027) bytes of data.
From rugrat (192.168.1.36) icmp_seq=1 Frag needed and DF set (mtu = 1500)
From rugrat (192.168.1.36) icmp_seq=1 Frag needed and DF set (mtu = 1500)
From rugrat (192.168.1.36) icmp_seq=1 Frag needed and DF set (mtu = 1500)
From rugrat (192.168.1.36) icmp_seq=1 Frag needed and DF set (mtu = 1500)
From rugrat (192.168.1.36) icmp_seq=1 Frag needed and DF set (mtu = 1500)
--- ipv4.thinkbroadband.com ping statistics ---
0 packets transmitted, 0 received, +5 errors

So, the 1492 MTU (1500 for me as I'm on PPPoA) actually impacts IPv4 and IPv6 in the same way i.e. fragmentation has to occur if necessary. The reason why the IPv6 ping fails to get through with the bigger packet sizes is because under IPv6 intermediate routers no longer fragment packets. Instead, this is now the sole responsibility of the host(s). For the hosts to know that it needs to fragment it relies on ICMP packet-too-big messages but there are many reasons why these either don't get generated or transferred.
Try ping6 without any fragmentation attempt (again using '-M do', although note that it doesn't set the DF bit because in IPv6 there is no DF bit but it will have the same effect for us here) and see what you get. This is what I see:
$ ping6 -s 9999 -c 5 ipv6.thinkbroadband.com -M do
PING ipv6.thinkbroadband.com(www.thinkbroadband.com) 9999 data bytes
From 2a02:16c8:2000:e00::36 icmp_seq=1 Packet too big: mtu=1500
From 2a02:16c8:2000:e00::36 icmp_seq=1 Packet too big: mtu=1500
From 2a02:16c8:2000:e00::36 icmp_seq=1 Packet too big: mtu=1500
From 2a02:16c8:2000:e00::36 icmp_seq=1 Packet too big: mtu=1500
From 2a02:16c8:2000:e00::36 icmp_seq=1 Packet too big: mtu=1500
--- ipv6.thinkbroadband.com ping statistics ---
0 packets transmitted, 0 received, +5 errors

Mathew
HairyMcbiker
All Star
Posts: 6,792
Thanks: 266
Fixes: 21
Registered: ‎16-02-2009

Re: ipv6 sloooow tonight

Quote from: AndyH
What if you put your router's IPv6 address in here http://www.letmecheck.it/mtu-test.php - do you get 1492 as your max MTU?

I can't get on to that site, just times out for me.
The ipv6chicken loads fine.
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

@ MJN
Thanks for the explanation.
What I am struggling to understand is how IPv6 packets work if they are too big to be passed through a link that cannot handle their size.
As you say - with IPv4, the packets can be fragmented by any link on their path. With IPv6, packets that are too large are fragmented solely by the source (devices in my network?). I suppose this makes IPv6 networks a lot more efficient as it saves resources.
So if my Mac sends a packet that is too big, it should receive a response from a link on its path that the packet was too big:
Quote
A Packet Too Big MUST be sent by a router in response to a packet
  that it cannot forward because the packet is larger than the MTU of
  the outgoing link.  The information in this message is used as part
  of the Path MTU Discovery process [PMTU].
  Sending a Packet Too Big Message makes an exception to one of the
  rules of when to send an ICMPv6 error message, in that unlike other
  messages, it is sent in response to a packet received with an IPv6
  multicast destination address, or a link-layer multicast or link-
  layer broadcast address.

But this doesn't seem to have happened looking at my Wiresharks. Also, it doesn't look like any of my packets were even above 1400.
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

Quote from: AndyH
So if my Mac sends a packet that is too big, it should receive a response from a link on its path that the packet was too big

Should being the operative word. Despite what the standards might require this doesn't necessarily mean the ICMP packet is actually being sent or transferred back to the sender.
I'm not saying with certainly that this is what is happening here but it is a definite possibility. Unfortunately when it comes to IPv6, standards compliance is in a bit of a mess. It doesn't help that the goalposts keep moving as we're stuck in a bit of a catch-22 as many vendors/operators are waiting for the standards to settle before committing whereas the IETF keep modifying the standards to try and encourage adoption.
Quote
Also, it doesn't look like any of my packets were even above 1400.

What size were they when sending the 9999 byte pings?
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

Quote from: MJN
What size were they when sending the 9999 byte pings?

The first one is 9999 - I had to clear the routing tables first to get it this size.
Quote from: MJN
I'm not saying with certainly that this is what is happening here but it is a definite possibility. Unfortunately when it comes to IPv6, standards compliance is in a bit of a mess. It doesn't help that the goalposts keep moving as we're stuck in a bit of a catch-22 as many vendors/operators are waiting for the standards to settle before committing whereas the IETF keep modifying the standards to try and encourage adoption.

It's certainly something to do with the MTU based on what we've seen so far. But it does seem very strange how it has occurred - my Mac/PC have default MTUs of 1500 (these have never changed) whereas my Asus router has a MTU of 1492. I can only assume that when flashing the new firmware, the MTU on the router changed to 1500 and and one link in the traffic route did not like the 1500 packet size.
In theory - if my router has an MTU of 1492 and my PC has a MTU of 1500 - then if I send a v6 packet of that size, it **should** get rejected first time.
I've tried this test (Mac MTU 1500 and router MTU 1492):
Quote
sh-3.2# ping6 -c 3 -s 1452 ipv6.thinkbroadband.com
PING6(1500=40+8+1452 bytes) 2a02:16c8:2000:1100:cca1:b25a:1e39:1691 --> 2a02:68:1::4
--- ipv6.thinkbroadband.com ping6 statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss

There seems to be no MTU Path Discovery.
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

It could be worth trying capturing a ping to somewhere you haven't visit before (ipv6.newtonnet.co.uk ?) but make sure you do capture the first attempt as it may well be caching results of such attempts and hence seemingly not trying later on.
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

Hmm I tried to send a 1501 byte packet packet (1453 + 40 + Cool  and the payload length of the first ping in the tcpdump was 32 bytes.
Something else I don't quite get - if I ping bbc.co.uk in v4 with a 1500 byte packet from my router, it works fine. If I try a 1501 byte packet, it fails to respond. If I do the same for www.plusnet.net, I get random results (2-3 dropped packets on a 5 ping count).
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

Can you upload the packet capture?
Have a look at this one and you can see that the echo request is split up in to 1448 byte chunks.
How does yours compare?
Your inconsistent IPv4 pings might simply be a result of rate limiting. ICMPv4 is widely treated with suspicion and so is often dropped or rate limited. This way of thinking will need to change in IPv6 as it is a fundamental part of the operation of the protocol. That change though will inevitably take some time.
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

Sure....will do some Wireshark captures.
Have a look at this:
Quote
andrew@ubuntu:~$ ping6 -c 3 -s 1452 ipv6.newtonnet.co.uk
PING ipv6.newtonnet.co.uk(secure.newtonnet.co.uk) 1452 data bytes
--- ipv6.newtonnet.co.uk ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
18:13:09.580444 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (0|1432) ICMP6, echo request, seq 1, length 1432
18:13:09.580464 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (1432|28)
18:13:10.580217 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (0|1432) ICMP6, echo request, seq 2, length 1432
18:13:10.580252 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (1432|28)
18:13:11.580216 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (0|1432) ICMP6, echo request, seq 3, length 1432
18:13:11.580249 IP6 2a02:16c8:2000:1100:95c4:xxxx:d655:xxxx > 2001:ba8:1f1:f137::2: frag (1432|28)

Quote
andrew@ubuntu:~$ ping6 -c 3 -s 1452 -M do ipv6.newtonnet.co.uk
PING ipv6.newtonnet.co.uk(secure.newtonnet.co.uk) 1452 data bytes
From 2a02:16c8:2000:1100:95c4:e2ba:d655:87d8 icmp_seq=1 Packet too big: mtu=1480
From 2a02:16c8:2000:1100:95c4:e2ba:d655:87d8 icmp_seq=1 Packet too big: mtu=1480
From 2a02:16c8:2000:1100:95c4:e2ba:d655:87d8 icmp_seq=1 Packet too big: mtu=1480
18:25:43.258482 IP6 2a02:16c8:2000:1100:95c4:e2ba:xxxx:xxxx > 2620:0:ccd::2: ICMP6, destination unreachable, unreachable port, 2a02:16c8:2000:1100:95c4:e2ba:xxxx:xxxx udp port 60991, length 122

So it looks like it is fragmenting them correctly, but I am still not getting an echo reply - which I still don't fully understand.
Edit: Done some further reading - so the fragmented packet needs to be reassembled at the destination (which sounds very inefficient). This does not seem to be happening, so there is no response to the ping request?
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

It might be that outbound everything is fine, however the large echo replies aren't making it back due to fragmentation. Maybe the router doesn't like fragmented packets because it can't make sense of them as far as security is concerned?
Incidentally, do you actually have a problem other than oddities with pings?
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

My understanding of all of this is that there seems to be no MTU path discovery for v6 traffic because no "packet too big" messages are being received. This has caused problems when the source device sends unfragmented packets larger than 1492 bytes (even fragmented packets don't seem to be handled correctly).
Juniper give a good explanation of what should happen:
Quote
IPv6 defines a standard mechanism called path MTU discovery that a source node can use to learn the path MTU of a path that a packet is likely to traverse. If any of the packets sent on that path are too large to be forwarded by a node along the path, that node discards the packet and returns an ICMPv6 Packet Too Big message. The source node can then adjust the MTU size to be smaller than that of the node that dropped it and sent the ICMPv6 message, and then retransmit the packet. A source node might receive Packet Too Big messages repeatedly until its packet traverses all nodes along the path successfully.

What I am not quite sure about is where these 'packet too big' messages should be coming from. Is it my router? modem? L2 Switch in the exchange? Plusnet's gateways? The host?
Something else which I did not realise is that, by default, Windows machines have an MTU of 1280 for v6. So I am not quite sure why I was still unable to access certain v6 sites with a low MTU. The MTU of the router shouldn't have made a difference (I think!).
Has anyone tried a v6 > v6 native VPN yet? This is something which would be interesting.
I've had no other issues now with v6 - I can access everything without a problem Smiley
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: ipv6 sloooow tonight

Quote from: AndyH
What I am not quite sure about is where these 'packet too big' messages should be coming from. Is it my router? modem? L2 Switch in the exchange? Plusnet's gateways? The host?

Whichever L3 device is unable to pass it on to the next link. This would typically mean a router between you and the destination.
Note that the host would never send them; it would only ever receive them.
jelv
Seasoned Hero
Posts: 26,785
Thanks: 971
Fixes: 10
Registered: ‎10-04-2007

Re: ipv6 sloooow tonight

Quote from: jelv
Wireshark has been uploaded to ticket 83851787

Does this suggest why it's so slow?
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£14.40/month)
Mobile: iD mobile (£4/month)
AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: ipv6 sloooow tonight

I think it's just the site has some kind of rate limit (around 30KB/s) for IPv6 traffic.
Pings to the site are identical v6 and v6.