dnssec and mtu size

[Daniel_Kavan]

Packet captures show we are missing the ecdns0 header.  Has anyone had to raise their interface MTU size to accommodate for DNSSEC?   Some one is suggesting to raise it to 4500.    Has anyone had any issues with a MTU size of 4500 over copper (1GB/s) ?    Meh, it looks like 1500 bytes is the max MTU for copper.   Does R81.20 support jumbo frames with fiber?  I assume so.  Yeah, it looks like it and also if you bond interfaces together.  I'm going to close this after reading other post on jumbo frames.

https://dnsinstitute.com/documentation/dnssec-guide/ch03s05.html#:~:text=You%20can%20use%20dig%20to%...

[Chris_Atkinson · Accepted solution]

It's potentially only part of the equation depending on what your connected infrastructure and ISP line supports.

Refer also: sk92835: Large DNS packets (eDNS) are dropped by the gateway

[G_W_Albrecht]

As sk92835 is completely EOL - what about currently supported versions ?

[Daniel_Kavan]

I'm curious if a large MTU size like 4500 would have complications with IPSEC site to site VPN tunnels as well on R81.20.

[G_W_Albrecht · Accepted solution]

See sk65264: What is Jumbo frame and MTU Maximum length:

jumbo frame MTU range is 1500-16,000

But this is depending on IF, see details in sk170533: "Failed to set MTU [XXXX] on interface" error and find the remark:

it is generally not recommended to set an MTU size of more than 9000

So 4500 should be possible if supported by the IFs used on the way to the internet. But best practice is to make MTU larger only in small steps until the issue is resolved.

[Daniel_Kavan]

So, you can use jumbo frames over copper, 1 Gbps or  you would need fiber?   Assuming  you set a copper interface to more that 1500, say 2500 to start then it automatically uses jumbo frame all the time and for every frame or just when needed?    Or how/where do you enable jumbo frame support?   So, leave MTU set to 1500 and enable jumbo frame support some where?

[G_W_Albrecht]

Afaik Framesize will be changed as needed by the traffic.  If MTU is set to 1500 you have no Jumbo frames. Did you not notice the IF types and values in sk170533 ?

sk98074: MTU and Fragmentation Issues in IPsec VPN

sk167357: MTU value mismatch after removing interface from bond

MTU is mostly discussed when using e.g. Path MTU Discovery Mode for cellular connections and small-band ISP connections. Fragmentation is the other half of the game...

[Daniel_Kavan]

Thanks for the suggestion Chris, I had both of those setting in sk92835 already in check.