On Mon, 10 Feb 2003 17:28:16 -0500, jpiszcz <jpiszcz@lucidpixels.com> wrote in message <3E482780.2090903@lucidpixels.com>: > http://iptables-tutorial.frozentux.net/iptables-tutorial.html > "As a secondary note, if you use connection tracking you will not see > any fragmented packets, since they are dealt with before hitting any > chain or table in iptables." > > PROBLEM: > > root@p300:/etc/rc.d# iptables -t filter -I INPUT -f -j LOG --log-level > 3 --log-prefix "FRAG: " > root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3 > --log-prefix "FRAG: " > root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3 > --log-prefix "FRAG: " > root@p300:/etc/rc.d# iptables -I INPUT -f -j DROP > > I've tried all of these, each one by itself. > > However, when I run tcpdump, I can clearly see these are not getting > dropped or logged by the kernel. > > I like conn_track for DCC/FTP connections, however, to get logging & > dropping of fragmented packets working properly, I must recompile > without the conn_tracker's? > > Wouldn't this be considered as a bug? Someone could be > pounding/scanning you with fragmented packets, and you would never see > > it, as many people run the DCC and/or FTP connection trackers! > > box1# nmap -sS -P0 -f -p 1-65535 box2.com > > 17:11:52.659286 box1.com > box2.com: (frag 2729:4@16) > 17:11:52.661416 box1.com > box2.com: (frag 986:4@16) > 17:11:52.663400 box1.com > box2.com: (frag 61814:4@16) > 17:11:52.665398 box1.com > box2.com: (frag 30216:4@16) > 17:11:52.667401 box1.com > box2.com: (frag 4100:4@16) > 17:11:52.669392 box1.com > box2.com: (frag 61387:4@16) > > 947 packets received by filter > 0 packets dropped by kernel > > Is it possible in anyway to log/drop/match fragmented packets with > connection tracking turned on? ..not tested etc; tried this in PREROUTING instead of INPUT? -- ..med vennlig hilsen = with Kind Regards from Arnt... ;-) ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
