http://iptables-tutorial.frozentux.net/iptables-tutorial.html
"As a secondary note, if you use connection tracking you will not see
any fragmented packets, since they are dealt with before hitting any
chain or table in iptables."
PROBLEM:
root@p300:/etc/rc.d# iptables -t filter -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j DROP
I've tried all of these, each one by itself.
However, when I run tcpdump, I can clearly see these are not getting
dropped or logged by the kernel.
I like conn_track for DCC/FTP connections, however, to get logging &
dropping of fragmented packets working properly, I must recompile
without the conn_tracker's?
Wouldn't this be considered as a bug? Someone could be
pounding/scanning you with fragmented packets, and you would never see
it, as many people run the DCC and/or FTP connection trackers!
box1# nmap -sS -P0 -f -p 1-65535 box2.com
17:11:52.659286 box1.com > box2.com: (frag 2729:4@16)
17:11:52.661416 box1.com > box2.com: (frag 986:4@16)
17:11:52.663400 box1.com > box2.com: (frag 61814:4@16)
17:11:52.665398 box1.com > box2.com: (frag 30216:4@16)
17:11:52.667401 box1.com > box2.com: (frag 4100:4@16)
17:11:52.669392 box1.com > box2.com: (frag 61387:4@16)
947 packets received by filter
0 packets dropped by kernel
Is it possible in anyway to log/drop/match fragmented packets with
connection tracking turned on?
Please CC me as I am not on the list.
On Mon, 2003-02-10 at 22:32, jpiszcz wrote:
> However, when I run tcpdump, I can clearly see these are not getting
> dropped or logged by the kernel.
Could your problem actually be a testing flaw? tcpdump sees firewalled
packets since it works at packet level, below the IP stack.
--
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source http://www.scaramanga.co.uk/gianni-at-ecsc.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
Other packets are shown as dropped by tcpdump, apparently others said
this is not a bug.
Also tried to log them etc, so either way was unsuccessful.
Gianni Tedesco wrote:
>On Mon, 2003-02-10 at 22:32, jpiszcz wrote:
>
>
>>However, when I run tcpdump, I can clearly see these are not getting
>>dropped or logged by the kernel.
>>
>>
>
>Could your problem actually be a testing flaw? tcpdump sees firewalled
>packets since it works at packet level, below the IP stack.
>
>
>