From: Bruno Wallace <bruno.wallace@gmail.com>
To: Jason Opperisano <opie@817west.com>, netfilter@lists.netfilter.org
Subject: Re: how to block udp frag?
Date: Mon, 3 Jan 2005 10:38:54 -0200 [thread overview]
Message-ID: <1139dfe205010304387b3b072@mail.gmail.com> (raw)
In-Reply-To: <20050102000845.GA11550@bender.817west.com>
the iptables dont see this traffic..
On Sat, 1 Jan 2005 19:08:45 -0500, Jason Opperisano <opie@817west.com> wrote:
> On Sat, Jan 01, 2005 at 09:58:41PM -0200, Bruno Wallace wrote:
> > hello,
> > how to block this?????
> >
> > 20:53:44.628586 83.102.166.15 > xxx.xxx.151.35: udp (frag 1720:25@512)
> > (ttl 53, len 45)
> > 0x0000 4500 002d 06b8 0040 3511 2599 5366 a60f E..-...@5.%.Sf..
> > 0x0010 c896 9723 11ef 0035 0019 1e70 71f7 0100 ...#...5...pq...
> > 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> > 20:53:47.197264 83.102.166.24 > xxx.xxx.151.34: udp (frag
> > 48577:25@512) (ttl 53, len 45)
> > 0x0000 4500 002d bdc1 0040 3511 6e87 5366 a618 E..-...@5.n.Sf..
> > 0x0010 c896 9722 11ef 0035 0019 1e68 71f7 0100 ..."...5...hq...
> > 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> > 20:53:49.306206 83.102.166.76 > xxx.xxx.145.115: udp (frag
> > 21990:25@512) (ttl 53, len 45)
> > 0x0000 4500 002d 55e6 0040 3511 dbdd 5366 a64c E..-U..@5...Sf.L
> > 0x0010 c896 9173 11ef 0035 0019 23e3 71f7 0100 ...s...5..#.q...
> > 0x0020 0001 0000 0000 0000 0000 0200 0100 ..............
> > 20:53:49.529603 83.102.166.7 > xxx.xxx.146.119: udp (frag
> > 26427:25@512) (ttl 53, len 45)
> > 0x0000 4500 002d 673b 0040 3511 c9c9 5366 a607 E..-g;.@5...Sf..
> > 0x0010 c896 9277 11ef 0035 0019 2324 71f7 0100 ...w...5..#$q...
> > 0x0020 0001 0000 0000 0000 0000 0200 0100
> >
> > thanks
> > Bruno Wallace
>
> either (a) use a default deny policy that doesn't allow UDP traffic or
> (b) in your rules where you accept UDP traffic, specify "! -f" which,
> according to the man page:
>
> When the "!" argument precedes the "-f" flag, the rule will only match
> head fragments, or unfragmented packets.
>
> -j
>
>
--
abraço,
Bruno Wallace
next prev parent reply other threads:[~2005-01-03 12:38 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-01 23:58 how to block udp frag? Bruno Wallace
2005-01-02 0:08 ` Jason Opperisano
2005-01-03 12:38 ` Bruno Wallace [this message]
-- strict thread matches above, loose matches on Subject: below --
2005-01-03 13:10 Piszcz, Justin Michael
2005-01-08 15:53 ` Andy Furniss
2005-01-08 17:33 ` ierdnah-ipt
2005-01-08 19:54 ` Andy Furniss
2005-01-08 20:17 ` Andy Furniss
2005-01-10 11:30 ` Andy Furniss
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1139dfe205010304387b3b072@mail.gmail.com \
--to=bruno.wallace@gmail.com \
--cc=netfilter@lists.netfilter.org \
--cc=opie@817west.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox