Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set (type 3, code 4) packets sent in response to a TCP packet doing PMTU discovery considered RELATED or does one need to allow NEW connections for such packets? By the way, is there a way to specify code number in the --icmp-type match? I think one can do -p 1 --icmp-type fragmentation-needed but I usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8. Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@xxxxxxxxxxxxxxxxxxx If you would like to participate in the development of an open source enterprise class network security management system, please visit http://iscs.sourceforge.net
