> > Actually, I was thinking it belongs in ip_output.c, with a switch
> > (-proto3?) that could be set per route to cap the TCP MSS at the MTU for
> > that route (or interface if there is no MTU for the route) for sessions
> > initiated external to the NetBSD box.
>
> This should work. But it must be turned off by default because it is
> a violation to normal router behaviour.
>
Yes, it looks more natural to do it at the ip level (this should be at tcp
level, but the
routing does not go so high). However, forgive me if I'm wrong here (I am
new to netbsd & ipfilter) but doesn't IPF shortcut ip_output sometimes ?
(the fastroute stuff)

I had the impression that it was talking directly to the interface, in this
case.
If this is so, then the ipfilter user will not benefit this feature ...

Regards,
Pascal.