{"action":"closed","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24254","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24254/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24254/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24254/events","html_url":"https://github.com/kubernetes/kubernetes/issues/24254","id":148403848,"number":24254,"title":"Amazon ELBs - ICMP and Network Maximum Transmission Unit (MTU)","user":{"login":"ajohnstone","id":173567,"avatar_url":"https://avatars.githubusercontent.com/u/173567?v=3","gravatar_id":"","url":"https://api.github.com/users/ajohnstone","html_url":"https://github.com/ajohnstone","followers_url":"https://api.github.com/users/ajohnstone/followers","following_url":"https://api.github.com/users/ajohnstone/following{/other_user}","gists_url":"https://api.github.com/users/ajohnstone/gists{/gist_id}","starred_url":"https://api.github.com/users/ajohnstone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajohnstone/subscriptions","organizations_url":"https://api.github.com/users/ajohnstone/orgs","repos_url":"https://api.github.com/users/ajohnstone/repos","events_url":"https://api.github.com/users/ajohnstone/events{/privacy}","received_events_url":"https://api.github.com/users/ajohnstone/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/networking","name":"area/networking","color":"006b75"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/platform/aws","name":"area/platform/aws","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/18","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.3","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/18/labels","id":1638460,"number":18,"title":"v1.3","description":"https://github.com/kubernetes/kubernetes/wiki/Release-1.3","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":64,"closed_issues":847,"state":"open","created_at":"2016-03-11T07:40:20Z","updated_at":"2016-06-20T18:07:41Z","due_on":"2016-06-24T07:00:00Z","closed_at":null},"comments":7,"created_at":"2016-04-14T15:48:19Z","updated_at":"2016-06-20T18:07:41Z","closed_at":"2016-06-20T18:07:41Z","body":"The firewall rules created on Amazon ELBs do not include ICMP. This means that issues can occur with PMTU. Please see below for more information.\r\n\r\nWhen a HTTP/TCP request exceeds a certain payload size, with ELBs not allowing \"ICMP request/reply\", the request stalls. This is due to the ELB trying to send big packets to the client but the client dropping them since the MTU was higher than expected.\r\n\r\nTo avoid this ICMP traffic should be allowed on the ELB so they can negotiate the MTU:\r\n\r\n * https://en.wikipedia.org/wiki/Path_MTU_Discovery\r\n * http://www.networkworld.com/article/2224654/cisco-subnet/mtu-size-issues.html\r\n * http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/network_mtu.html\r\n\r\nWhen enabling ICMP traffic the client will be able to communicate with the ELB normally.\r\n\r\nAn example of what occurs when ICMP is not enabled.\r\n\r\n```\r\n$ time curl -v -O > /dev/null http://a8222e4ee025111e6a25d0a91ac3ee4d-1379358768.eu-west-1.elb.amazonaws.com/docs-api/swaggerui/lib/jquery.slideto.min.js\r\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\r\n                                 Dload  Upload   Total   Spent    Left  Speed\r\n  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 52.49.165.25...\r\n* Connected to a8222e4ee025111e6a25d0a91ac3ee4d-1379358768.eu-west-1.elb.amazonaws.com (52.49.165.25) port 80 (#0)\r\n> GET /docs-api/swaggerui/lib/jquery.slideto.min.js HTTP/1.1\r\n> Host: a8222e4ee025111e6a25d0a91ac3ee4d-1379358768.eu-west-1.elb.amazonaws.com\r\n> User-Agent: curl/7.43.0\r\n> Accept: */*\r\n> \r\n  0     0    0     0    0     0      0      0 --:--:--  0:00:29 --:--:--     0< HTTP/1.1 200 OK\r\n< content-length: 369\r\n< content-type: application/javascript; charset=utf-8\r\n< last-modified: Thu, 12 Feb 2015 14:06:22 GMT\r\n< etag: \"b849bafad46251cbced13d4b501694dd21bd7464\"\r\n< cache-control: no-cache\r\n< accept-ranges: bytes\r\n< Date: Thu, 14 Apr 2016 15:31:06 GMT\r\n< Connection: keep-alive\r\n< \r\n{ [369 bytes data]\r\n100   369  100   369    0     0     12      0  0:00:30  0:00:29  0:00:01    85\r\n* Connection #0 to host a8222e4ee025111e6a25d0a91ac3ee4d-1379358768.eu-west-1.elb.amazonaws.com left intact\r\n\r\nreal\t0m29.547s\r\nuser\t0m0.012s\r\nsys\t0m0.004s\r\n\r\n```\r\n\r\nIdeally security rules for ELBs should be allowed to be attached to an ELB via annotations and/or by default.\r\n\r\nICMP rules at a minimum to avoid this should cover:\r\n\r\n * 0 - Echo Reply\r\n * 8 - Echo Request\r\n\r\n** Please note that this does not just affect Amazon ELBs, but in addition direct access to instances too.**\r\n"}}
{"actor":{"display_login":"k8s-merge-robot"}}