In some email I received from Alex Zhilyakov, sie wrote: > Hello Darren, > > Thanks for the answer. I tested same scenario vs FreeBSD - problem > persists, so it is not only Linux behaviour. > Generally speaking, frags are not required to come in order to > destination box, and as such wrong order of arrival can not be an "excuse" > to not process them properly. Normal IP stack reassembles them just fine. > Is there any special reasoning why IPF must not do so as well?
IP Filtre doesn't do fragment reassembly of any sort, including keeping fragments on hold somewhere. The problem is this. You have UDP fragements that come in with no UDP header, so there is no port information, and of course the packet cannot match any rule that has a port number. The IP stack isn't necessarily concerned with providing security, just the means to receive and defragment packets. Darren
