Re: IP defrag (was RE: ipchains blocking port 65535)

On Wed, Jan 17, 2001 at 05:44:30PM -, Tony Gale wrote: > > On 17-Jan-2001 Andi Kleen wrote: > > > > Connection tracking always defrags as needed. > > masquerading/NAT/iptables > > with connection tracking uses that. > > > > This means that if any of these are enabled and your machine acts

Re: IP defrag (was RE: ipchains blocking port 65535)

On 17-Jan-2001 Andi Kleen wrote: > > Connection tracking always defrags as needed. > masquerading/NAT/iptables > with connection tracking uses that. > > This means that if any of these are enabled and your machine acts > as a > router lots of CPU could get burned in defragmentation, and packe

Re: IP defrag (was RE: ipchains blocking port 65535)

On Wed, Jan 17, 2001 at 05:15:54PM -, Tony Gale wrote: > > On 17-Jan-2001 Jussi Hamalainen wrote: > > On Wed, 17 Jan 2001, Tony Gale wrote: > > > >> It looks like this is due to the odd way in which ipchains handles > >> fragments. Try: > >> > >> echo 1 > /proc/sys/net/ipv4/ip_always_defrag

IP defrag (was RE: ipchains blocking port 65535)

On 17-Jan-2001 Jussi Hamalainen wrote: > On Wed, 17 Jan 2001, Tony Gale wrote: > >> It looks like this is due to the odd way in which ipchains handles >> fragments. Try: >> >> echo 1 > /proc/sys/net/ipv4/ip_always_defrag > > Thanks, this seems to do the trick. Does this oddity still exist > in