Hello,
I'm having weird problems with fragmented UDP and ipf. ipf is set to
"pass... udp... keep frags". However, if UDP comes fragmented, it does not
get to my application.
This is what I see in tcpdump:
IP 66.193.84.130 > 66.193.84.149: udp
IP 66.193.84.130.32795 > 66.193.84.149.5060: UDP, length: 1493
(note that 2nd frag comes before 1st frag)
This is what ipmon shows:
11/11/2004 14:53:05.761101 STATE:NEW 66.193.84.130,32795 ->
66.193.84.149,5060 PR udp
BUT, the fragments are stuck in ipf buffers and do not get through:
#ipfstat -f
IP fragment states:
2 new
1 expired
0 hits
0 no memory
0 already exist
1 inuse
66.193.84.130 -> 66.193.84.149 50499 112 17 00 = 0x580a
And this fragment sits there until it expires in few minutes:
11/11/2004 14:55:05.410123 STATE:EXPIRE 66.193.84.130,32795 ->
66.193.84.149,5060 PR udp Pkts 2 Bytes 1612
#ipfstat -f
IP fragment states:
2 new
2 expired
0 hits
0 no memory
0 already exist
0 inuse
ipf config:
#ipfstat -io
empty list for ipfilter(out)
pass in quick on hme0 proto icmp from any to any
pass in quick on hme0 proto udp from any to any port = 5060 keep state
keep frags
pass in quick on hme0 proto udp from any port = 53 to any
pass in quick on hme0 proto tcp from any to any port = 22 flags S/FSRPAU
keep state keep frags
block in on hme0 from any to any
#ipf -V
ipf: IP Filter: v3.4.32 (496)
Kernel: IP Filter: v3.4.32
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1
Could somebody have a look at all this and provide comments on it, or
suggest how to solve the problem? Thank you.
-Alex Zhilyakov
Network Manager, Accatel Inc.
+1-212-3794000
