Re[1] about ip fragmentation
I use the DOS ping command. The -l option allow to specify the length ot the icmppackets.
"iptables -A FORWARD ! -f -p icmp -j DROP" should only drop the first fragment or the unfragmented packets
Greg
Quoted 1 line
I can confirm your finding. "iptables -A FORWARD -f -p
icmp -j DROP"
Quoted 1 line
does not drop the second and further fragments of
fragmented icmp
Quoted 1 line
packets. However, "iptables -A FORWARD ! -f -p icmp -j
DROP" does
Quoted 1 line
work as predicted. Can someone shed some light on this
behavior?
Quoted 3 lines
Ramin
PS. I don't know which ping implementation you're using
but on my
Quoted 1 line
machine "-l" means "ping sends that many packets as fast
as
Quoted 1 line
possible before ..." and "-s" specifies the number of
data bytes
Quoted 3 lines
to be sent.
On Thu, May 09, 2002 at 08:51:21AM +0000, gregory gilbert
Quoted 4 lines · wrote:
Quoted 4 lines
Hi
i am a new user of iptables and i already have a
problem :
Quoted 6 lines
Quoted 6 lines
i have ton conigure a firewall with iptables command. I have this first very simple rule:
iptables -A FORWARD -f -p icmp -j DROP
i think this rule should drop any 2nd, or 3rd and so
on ...
Quoted 2 lines
Quoted 2 lines
fragment of a ping command.
But if i ping a computer and the icmp packet goes
through
Quoted 1 line
Quoted 1 line
my firewall, i can see some fragments after the
firewall (i
Quoted 2 lines
Quoted 2 lines
use tcpdump). It seems this rule is not applied. The fragmented packets are before and after my linux
firewall.
Quoted 3 lines
Quoted 3 lines
So i have a question : is there any ip defragmentation before the rules of the iptables are applied by the firewall? I mean, i wonder if some fragments are
received
Quoted 1 line
Quoted 1 line
by iptables, or if the defragmentation occures before
(it
Quoted 1 line
Quoted 1 line
would be strange : the -f or ! -f flags exist ... so
the
Quoted 3 lines
Quoted 3 lines
defragmentation should occur after the iptables rules application)
Or is there a mistake in my command? Or did i
misunderstand
Quoted 7 lines
Quoted 7 lines
something with iptables?
In fact, if i just add the following command :
iptables -A FORWARD -p icmp -j DROP
all the packets are dropped (the first fragment, the
second
Quoted 2 lines
Quoted 2 lines
and so on ...).
But if i just want to drop the 2nd, the 3rd ...
fragments ,
Quoted 7 lines
Quoted 7 lines
i don't know which iptables rule to add.
To ensure i have fragments, i ping this way :
ping -l 2000 x.x.x.x
and i can see the fragments with tcpdump.I really can't understand why my firewall does not
behave
Quoted 4 lines
Quoted 4 lines
the way i predicted. So could you help me?
Greg
_________________________________________________________
Quoted 1 line
Quoted 1 line
Envoyez des messages musicaux sur le portable de vos
amis
Quoted 6 lines
Quoted 2 lines
______________________________________________________
Boîte aux lettres - Caramail - http://www.caramail.com