>So, ftp connection tracking doesn't work always. Just curious about >what is the rationale for such a solution? Is it assumed that if the >packet with PORT command is fragmented someone is deliberatly attacking >the system? Yes you can assume that. FTP commands are usually not that long to not fit into a small packet. -`J' --
