Single-packet race condition breaking the 65535 byte lim

Please don’t correct the title, it’s delightful as it is.

It should be noted that IP fragmentation is quite limited and often buggy. IPv6 only requires receivers to re-assemble an IP packet that is at most 1500 bytes, so sending a 65KB TCP segment is quite likely to just result in dropped packets.<p>Alternatively, the 1500 limit is not a hard limit, and depends entirely on your link. Jumbo frames (~9000 bytes) and even beyond are possible if all the devices are configured in the right way. Additionally, IPv6 actually supports packets up to ~4GiB in size (so called &quot;jumbograms&quot;, with an additional header), though I think it would be truly hard to find any network which uses this feature.

BTW, you don’t have to rent servers on opposite sides of the planet just to increase network latency for testing.<p><pre><code> tc qdisc add dev eth0 root netem delay 200ms</code></pre>

So, is this a DoS technique or what? Or trying to avoid TCP side transmission rate limits, which anyway should be implemented IP side?

This technique is briefly discussed in chapter 5.3.1 in the master thesis &quot;Exploiting Race Conditions in Web Applications with HTTP&#x2F;2&quot; - <a href="https:&#x2F;&#x2F;ntnuopen.ntnu.no&#x2F;ntnu-xmlui&#x2F;handle&#x2F;11250&#x2F;2781157" rel="nofollow">https:&#x2F;&#x2F;ntnuopen.ntnu.no&#x2F;ntnu-xmlui&#x2F;handle&#x2F;11250&#x2F;2781157</a><p>The same paper is also referenced to by James Kettle in his research.

I assume with HTTP&#x2F;1.1 this would be less useful, since each synchronized request would require another socket, thus hitting potential firewalls limiting SYN&#x2F;SYN-ACK rate and&#x2F;or concurrent connections from the same IP.<p>In some respects this is abusing the exact reason we got HTTP&#x2F;3 to replace HTTP&#x2F;2 – it&#x27;s a deliberate Head-of-Line (HoL) blocking.

This title is about as apt as my username

&quot;Its not clear why TCP settled on such an oddly specific number&quot;