Apparently, SSL generates IPv4 "too bigs" (posted 2014-12-19)

Yesterday, I wrote:

❝In almost a week, I received zero IPv4 "too big" messages.

So it seems in the IPv4 world, path MTU discovery is dead.❞

However, João Taveira Araújo told me that he sees a good number of IPv4 ICMP "too big" messages. Those seem to result from SSL traffic. At first, that seemed strange, as SSL is just payload for TCP so TCP MSS clamping should work on SSL sessions the same as on non-SSL sessions.

But then I realized that this traffic could be SSL VPNs. If a VPN gateway takes an IPv4 packet and encapsulates that in SSL in a single TCP segment, then the size of those TCP segments isn't influenced by MSS clamping, so too big messages will be generated if the path MTU is smaller than the MTUs of the endpoints of the SSL connection. I wonder if those SSL VPN implementations handle path MTU discovery properly, though.