On Wed, Apr 30, 2014 at 12:54:50PM +0400, Vasily Averin wrote: > Currently bridge can silently drop ipv4 fragments. > If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4, > br_nf_pre_routing defragments incoming ipv4 fragments > but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined packet back, > and therefore it is dropped in br_dev_queue_push_xmit without incrementing of any failcounters Patrick already mentioned that bridges should not defragment unless conntrack is enabled. Please, see: http://marc.info/?l=netfilter-devel&m=139878065822267&w=2 I think we have to consider some alternative way to fix what you report. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
