On Wednesday 2011-05-18 06:27, Pandu Poluan wrote: > >If you want to drop all fragmented packets, including the first packet >of the fragment, > >iptables -t raw -A PREROUTING -m u32 ! --u32 0x4&0x3fff=0x0 -m comment >--comment \"Fragmented\" -j DROP Yeah but you forget iptables -f -j DROP and that, when nf_defrag is loaded, autodefragmentation is happening and Xtables won't see any more fragments. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
