On 31/08/15 at 14:03, Andreas Herz wrote: > While playing around with the IPv6 extension headers i found a strange > behaviour when it comes to the IPv6 fragmentation header. First i used the > thc-ipv6 toolkit with that i could trigger the issue below in the first place. > > [...] > > Does anyone have an idea why this happens and where i might need to look for > this issue? Florian Westphal pointed out that it might be conntrack defrag and yes, on systems without it i see the frag header in iptables. So if defrag is on i have no chance to filter specific fragmentations i guess and just hope that the defrag process sorts every messed up stuff out ;) Thanks -- Andreas Herz -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
