Am Don, 2003-10-09 um 15.43 schrieb Abraham van der Merwe: > Hi! > > Are there any iptables extensions out there that allow you to clear the DF > (Dont Fragment) bit in ip headers? If you clear the DF-Bit and use Linux on either side of the tunnel where the packets are fragmented you are in deep trouble, because Linux 2.4 (when using PMTU) not only sets the DF-Bit but also clears the IP-ID which is needed to defragment the packets again. So, when clearing the DF-Bit you have to ensure unique numbers in the IP-ID field, too. Cheers, Ralf -- Ralf Spenneberg RHCE, RHCX Book: Intrusion Detection für Linux Server http://www.spenneberg.com IPsec-Howto http://www.ipsec-howto.org Honeynet Project Mirror: http://honeynet.spenneberg.org
