On Thu, May 19, 2011 at 15:43, Pandu Poluan <pandu@xxxxxxxxxxx> wrote: > On Wed, May 18, 2011 at 19:23, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: >> >> On Wednesday 2011-05-18 06:27, Pandu Poluan wrote: >>> >>>If you want to drop all fragmented packets, including the first packet >>>of the fragment, >>> >>>iptables -t raw -A PREROUTING -m u32 ! --u32 0x4&0x3fff=0x0 -m comment >>>--comment \"Fragmented\" -j DROP >> >> Yeah but you forget >> >>    Âiptables -f -j DROP >> >> and that, when nf_defrag is loaded, autodefragmentation is happening and >> Xtables won't see any more fragments. >> > > Why should I match against -f ? Doesn't " ! --u32 0x4&0x3fff=0x0 " > already match against the first and subsequent packets? > Um, maybe I need to explain it clearer: 0x3fff matches bits 18~31 of the 32 bits taken from octet 4. Bit #19~31 indicates the fragment offset. Non-zero for subsequent fragments, zero for first fragment. Bit #18 is the "More Fragment" bit. So, if the packet is fragmented, Bits #18~31 can't all be '0'; bit #18 will be '1' for all packets *except* the last fragmented packet, and bits #19~31 will be non-zero for all packets *except* the first fragmented packet. Reference: * http://www.wtcs.org/snmp4tpc/images/IP-Header.jpg * http://www.stearns.org/doc/iptables-u32.current.html (near the end of the page) > And when does nf_defrag actually do its magic? Doesn't it take place > during conntrack, and thus after '-t raw' ? > -- Pandu E Poluan ~ IT Optimizer ~ Visit my Blog: http://pepoluan.posterous.com Google Talk: pepoluan Y! messenger: pepoluan MSN / Live: pepoluan@xxxxxxxxxxx (do not send email here) Skype: pepoluan More on me:ÂÂMy LinkedIn Account My Facebook Account -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
