On Wed, Dec 18, 2013 at 12:58 AM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > With this patch, an ICMP destination unreachable - fragmentation > needed coming after a big UDP packet will trigger the removal of the > UDP conntrack entry, that should not happen. I don't think this is a problem, as the conntrack is unreplied and the original packet is dropped. That means the no virtual circuit is setup along the path, so why do we keep the partial circuit? And the later restranmitted packet will set up a new conntrack in anyway. Thanks. -- Regards, Changli Gao(xiaosuo@xxxxxxxxx) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
