my objective is to drop all fragmented packets on my system following rules are used iptables -A INPUT -f -j DROP iptables -A OUTPUT -f -j DROP iptables -A FORWARD -f -j DROP above rules are not making any effect For information, there is no connection tracking support on my kernel.Since i understand that if connection tracking is enabled on kernel then filtering based on fragmentation won't work, so i have remeved connection tracking support. i am using ping -s 32768 10.2.2.2 for generating fragments Am i doing something wrong or is there anything that is conflicting with these rules Thanks in advance. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
