Reputation
219
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 2 12
Newest
 Yearling
Impact
~21k people reached

  • 0 posts edited
  • 0 helpful flags
  • 4 votes cast
Sep
5
comment Drop IP fragments of a certain protocol
I used tc, in fact. There are also minimal performance improvements when early filtering in tc, see meat.pisto.horse/2014/10/…
Sep
3
comment Drop IP fragments of a certain protocol
I think you should be looking at tc input filtering. You can do things before packets even hit the netfilter hooks.
Jul
29
comment Linux iptables DNAT on incoming packet without conntrack (stateless)
No, sorry, DNETMAP still uses conntrack.
Jul
29
comment Linux iptables DNAT on incoming packet without conntrack (stateless)
There used to be a RAWDNAT and RAWSNAT target in xtables-addons. Now I believe their functionality has been absorbed by DNETMAP.
Jul
16
awarded  Yearling
Apr
22
awarded  Famous Question
Mar
27
awarded  Critic
Oct
1
awarded  Supporter
Sep
24
awarded  Autobiographer
Sep
9
awarded  Popular Question
Jun
10
awarded  Popular Question
May
12
awarded  Commentator
Dec
25
comment Drop IP fragments of a certain protocol
As long as conntrack is loaded, -f is always false, because the packet is always reconstructed.
Oct
16
awarded  Nice Question
Oct
15
awarded  Editor
Oct
15
revised Drop IP fragments of a certain protocol
added 3 characters in body
Oct
15
asked Drop IP fragments of a certain protocol
Sep
27
asked Set an ipv6-specific MTU
Apr
4
awarded  Notable Question
Nov
23
awarded  Popular Question