Community discussions

MikroTik App
 
NenadS
just joined
Topic Author
Posts: 13
Joined: Wed May 31, 2006 4:39 pm

MTU and MSS with new internal algorithm

Tue May 09, 2017 10:46 pm

Hello,

Before I've upgraded my Mikrotik to the newest version for L2TP MTU of 1462 I had 1422 MSS (40 bytes less) in Firewall Mange and it was fine. After upgrade, I have 1416 MSS (captured with Wireshark because there is no more Mangle rules for MSS).

Could you please explain why is MMS different now?

Thanks!
 
idlemind
Forum Guru
Forum Guru
Posts: 1147
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: MTU and MSS with new internal algorithm

Wed May 10, 2017 12:35 am

What is the output of:
/interface l2tp-server server print
 
NenadS
just joined
Topic Author
Posts: 13
Joined: Wed May 31, 2006 4:39 pm

Re: MTU and MSS with new internal algorithm

Wed May 10, 2017 10:31 am

[admin@MT] > /interface l2tp-server server print 
            enabled: yes
            max-mtu: 1462
            max-mru: 1462
               mrru: disabled
     authentication: chap
  keepalive-timeout: 30
       max-sessions: unlimited
    default-profile: default
          use-ipsec: no
       ipsec-secret: 
    allow-fast-path: no
[admin@MT] > 
Also, in default profile I set "Change TCP MMS" to yes.
 
idlemind
Forum Guru
Forum Guru
Posts: 1147
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: MTU and MSS with new internal algorithm

Thu May 11, 2017 7:55 am

Alright, I labbed this up and the default in the latest RC is 1450 for MTU / MRU and I'm seeing a MSS of 1404. This is like yours, 6 bytes lower than I'd expect to see. We may want to move this to the RC thread to get a more accurate explanation. I'm not seeing anything that stands out as to why.
 
NenadS
just joined
Topic Author
Posts: 13
Joined: Wed May 31, 2006 4:39 pm

Re: MTU and MSS with new internal algorithm

Thu May 11, 2017 9:49 am

Also, in previous release (before internal algorithm for MSS presented) 6.38.5, I had different values for MSS in-interface and for MSS out-interface but both MTU and MRU had equal values of 1462.

First case:
MTU/MRU: 1450 -> MSS-out 1452, MSS-in 1410
Second case:
MTU/MRU 1462 -> MSS-out 1452, MSS-in 1422
As you can see MSS for in-interface is OK.

MSS-out values are equal in both cases for different MTU/MRU values and it's wrong (I had problem with upload data to remote servers). It should be MRU - 40B if I'm not wrong.

Solution is to disable Change TCP MSS value and manually add these two rules in Mangle:
/ip firewall mangle
add action=change-mss chain=forward new-mss=1422 out-interface=all-ppp \
    passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1423-65535
add action=change-mss chain=forward in-interface=all-ppp new-mss=1422 \
    passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1423-65535
For now I have no package drops and everything seems to work fine.
 
User avatar
strods
MikroTik Support
MikroTik Support
Posts: 1438
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: MTU and MSS with new internal algorithm

Thu May 11, 2017 10:45 am

In our built-in change-mss implementation 6 bytes are reserved just in case connection is MLPPP.
 
NenadS
just joined
Topic Author
Posts: 13
Joined: Wed May 31, 2006 4:39 pm

Re: MTU and MSS with new internal algorithm

Thu May 11, 2017 11:57 am

In our built-in change-mss implementation 6 bytes are reserved just in case connection is MLPPP.
Thanks for letting me know!

If I don't use MLPPP I should disable Change TCP MSS in profile and manually add those two rules?

If I have equal values for MTU/MRU, does it mean that MSS value for in and out interfaces​ should be equal too?
tcp_mss.PNG
L2TP Server has MTU/MRU 1462.

First connection shows MSS 1422 when Change TCP MSS is set to no.
Second connection shows MSS 1416 when Change TCP MSS is set to yes.
You do not have the required permissions to view the files attached to this post.

Who is online

Users browsing this forum: matiss, quackyo and 72 guests