On Wed, May 18, 2011 at 19:23, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: > > On Wednesday 2011-05-18 06:27, Pandu Poluan wrote: >> >>If you want to drop all fragmented packets, including the first packet >>of the fragment, >> >>iptables -t raw -A PREROUTING -m u32 ! --u32 0x4&0x3fff=0x0 -m comment >>--comment \"Fragmented\" -j DROP > > Yeah but you forget > > Â Â Â Âiptables -f -j DROP > > and that, when nf_defrag is loaded, autodefragmentation is happening and > Xtables won't see any more fragments. > Why should I match against -f ? Doesn't " ! --u32 0x4&0x3fff=0x0 " already match against the first and subsequent packets? And when does nf_defrag actually do its magic? Doesn't it take place during conntrack, and thus after '-t raw' ? Rgds, -- Pandu E Poluan ~ IT Optimizer ~ Visit my Blog: http://pepoluan.posterous.com -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
