NAME

SYNOPSIS

DESCRIPTION

This is necessary in many setups to avoid problems caused by routers that drop ICMP “Datagram Too Big” messages, thus breaking the Path MTU Discovery algorithm (RFC 1191). Without these messages, the originating machine sends data, it passes the rogue router then hits a machine that has an MTU that is not big enough for the data. Because the IP “don't fragment” option is set, this machine sends an ICMP “Datagram Too Big” message back to the originator and drops the packet. The rogue router drops the ICMP and the originator never gets to discover that it must reduce the Path MTU value or exclude the IP “don't fragment” option from its outgoing data.

The tcpmssd utility normally runs in the background as a daemon. It intercepts TCP packets from a divert(4) socket bound to the port specified with the -p option and reduces the value of TCP MSS option if necessary so that the incoming TCP messages will pass through this host without need to send ICMP “Datagram Too Big” messages.

The maximum value for the TCP MSS option is determined based on an MTU given either as an absolute value with the -m option or derived from a network interface specified with the -i option.

If run with the -b option, tcpmssd will attempt to update the TCP MSS option on both incoming and outgoing TCP segments, as delivered on the divert(4) socket. By default, only outgoing TCP segments are examined.

If run with the -v option, tcpmssd does not detach from its controlling terminal and writes various diagnostic messages to the standard error output.

The following steps are necessary to run tcpmssd:

1. Build your kernel with the following options:

   options IPFIREWALL
   options IPDIVERT
       

   Refer to the Handbook for detailed instructions on building a custom kernel.

2. Make sure to redirect TCP traffic to the divert(4) port port. Refer to the ipfw(8) manual page for details.

SEE ALSO

AUTHORS