Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running an application that injects iptables connection tracking rules into the kernel so the machine can forward incoming UDP traffic to its destination as fast as possible.

Some of the traffic received on this machine is not quite according to spec and the receiving party is not always handling this traffic as it should. Unfortunately the sending hardware supplier says there's nothing wrong with what they're sending and the receiving party supplier says the sender should never send traffic like that, so I'm caught in the middle trying to solve a problem.

The server where I have full control over the traffic uses iptables connection tracking to forward the traffic from one sending party to the receiving party using input from another application. The offending traffic is easily recognizable, it is the only traffic using 0 length UDP payload being sent by the sending party.

How do I make sure my iptables rule dropping the offending traffic is being triggered before conntrack forwards the UDP messages?

Using iptables -A INPUT -p udp --dport 50000:60000 -m length --length 8 -j DROP doesn't work, the packets still flow through the machine. I also tried with a length of 8 (the UDP header size) but the result is the same.

share|improve this question

To filter traffic being forwarded, you need the FORWARD chain, the INPUT chain is for traffic destined for system on which the rule is on.

share|improve this answer
The traffic is being sent to a local IP address on the server, the conntrack rule then forwards it to a new destination IP address. Using the forward chain also doesn't appear to be doing anything if I filter on the IP address of the server, either as source or destination – ramdyne Dec 1 '11 at 13:54
up vote 0 down vote accepted

As Timothy Baldwin suggested the filter should be on the FORWARD chain. The length parameter doesn't work on the UDP payload or packet length, but on the IP packet length naturally

So the command that works is iptables -A FORWARD -p udp --dport 50000:60000 -m length --length 28 -j DROP where the length is 20 bytes for the IP heaer and 8 for the UDP header

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.