From: Jason Opperisano <opie@817west.com>
To: netfilter@lists.netfilter.org
Subject: Re: how to block udp frag?
Date: Sat, 1 Jan 2005 19:08:45 -0500 [thread overview]
Message-ID: <20050102000845.GA11550@bender.817west.com> (raw)
In-Reply-To: <1139dfe2050101155841faa4d0@mail.gmail.com>
On Sat, Jan 01, 2005 at 09:58:41PM -0200, Bruno Wallace wrote:
> hello,
> how to block this?????
>
> 20:53:44.628586 83.102.166.15 > xxx.xxx.151.35: udp (frag 1720:25@512)
> (ttl 53, len 45)
> 0x0000 4500 002d 06b8 0040 3511 2599 5366 a60f E..-...@5.%.Sf..
> 0x0010 c896 9723 11ef 0035 0019 1e70 71f7 0100 ...#...5...pq...
> 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> 20:53:47.197264 83.102.166.24 > xxx.xxx.151.34: udp (frag
> 48577:25@512) (ttl 53, len 45)
> 0x0000 4500 002d bdc1 0040 3511 6e87 5366 a618 E..-...@5.n.Sf..
> 0x0010 c896 9722 11ef 0035 0019 1e68 71f7 0100 ..."...5...hq...
> 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> 20:53:49.306206 83.102.166.76 > xxx.xxx.145.115: udp (frag
> 21990:25@512) (ttl 53, len 45)
> 0x0000 4500 002d 55e6 0040 3511 dbdd 5366 a64c E..-U..@5...Sf.L
> 0x0010 c896 9173 11ef 0035 0019 23e3 71f7 0100 ...s...5..#.q...
> 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> 20:53:49.529603 83.102.166.7 > xxx.xxx.146.119: udp (frag
> 26427:25@512) (ttl 53, len 45)
> 0x0000 4500 002d 673b 0040 3511 c9c9 5366 a607 E..-g;.@5...Sf..
> 0x0010 c896 9277 11ef 0035 0019 2324 71f7 0100 ...w...5..#$q...
> 0x0020 0001 0000 0000 0000 0000 0200 0100
>
> thanks
> Bruno Wallace
either (a) use a default deny policy that doesn't allow UDP traffic or
(b) in your rules where you accept UDP traffic, specify "! -f" which,
according to the man page:
When the "!" argument precedes the "-f" flag, the rule will only match
head fragments, or unfragmented packets.
-j
next prev parent reply other threads:[~2005-01-02 0:08 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-01 23:58 how to block udp frag? Bruno Wallace
2005-01-02 0:08 ` Jason Opperisano [this message]
2005-01-03 12:38 ` Bruno Wallace
-- strict thread matches above, loose matches on Subject: below --
2005-01-03 13:10 Piszcz, Justin Michael
2005-01-08 15:53 ` Andy Furniss
2005-01-08 17:33 ` ierdnah-ipt
2005-01-08 19:54 ` Andy Furniss
2005-01-08 20:17 ` Andy Furniss
2005-01-10 11:30 ` Andy Furniss
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050102000845.GA11550@bender.817west.com \
--to=opie@817west.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.