路由器是否验证 IP 数据包长度?

网络工程 路由 ipv4 安全
2021-07-10 13:11:19

路由器是否使用数据包中提到的来验证实际的 IP 数据包大小?

1个回答

路由器应该检查 IP 长度,但不是必需的。如果他们检查,他们需要丢弃 IP 标头中的值与实际数据包长度之间的不匹配。路由器应依赖于链路层负载检测,并与每个 RFC 1812 的 IP 标头进行比较。

这在RFC 1812 - Requirements for IPv4 Routers, Section 5.2.2: IP Header Validation 中有介绍

  Additionally, the router SHOULD verify that the packet length
  reported by the Link Layer is at least as large as the IP total
  length recorded in the packet's IP header.  If it appears that the
  packet has been truncated, the packet MUST be discarded, the error
  SHOULD be logged, and the router SHOULD respond with an ICMP
  Parameter Problem message whose pointer points at the IP total length
  field.
DISCUSSION
  Because any higher layer protocol that concerns itself with data
  corruption will detect truncation of the packet data when it
  reaches its final destination, it is not absolutely necessary for
  routers to perform the check suggested above to maintain protocol
  correctness.  However, by making this check a router can simplify
  considerably the task of determining which hop in the path is
  truncating the packets.  It will also reduce the expenditure of
  resources down-stream from the router in that down-stream systems
  will not need to deal with the packet.