Robert Elz writes:
>   | Among other things, it probably breaks path MTU discovery.
> 
> I thought that was the idea ... that is, PMTU discovery breaks in the
> presence of broken firewalls, so rather than fix the firewalls

Ah, but I think people have to fix the firewalls. Lots and lots of
machines are doing PMTU discovery. If you filter all ICMP, well, lots
of connections to you are going to lose, not just ours if you have
PMTU on.

Perry