Does now IPFilter support reassemble IP fragments?
"Xiaohong Liu" <[email protected]> Thu, 18 Nov 2010 02:26:30 -0600
| Newsgroups | gmane.comp.security.firewalls.ipfilter |
|---|---|
| Message-ID | <18660_1290068985_4CE4E3F8_18660_2147_1_0162EBEA27F7CB4D9DB0DBA1D6CF93A902D37C39@zrc2hxm1.corp.nortel.com> |
This is a multi-part message in MIME format. ------_=_NextPart_001_01CB86FA.4DF8EA3D Content-Type: multipart/alternative; boundary="----_=_NextPart_002_01CB86FA.4DF8EA3D" ------_=_NextPart_002_01CB86FA.4DF8EA3D Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, all I use IP filter v4.1.9(592) on Solaris 10 U8.=20 During testing, I observe that IPFilter will block the fragmented packets out of order when the server doesn't receive the first segment before any of others.=20 Snoop packets are given as an example as the following: Packet 1 & 3 are dropped. Packet 2 & 4 are passed, but waiting for the later fragment. As a result of the packets dropping, ICMP of reassembly time exceeded packets are sent out finally. 1 0.00000 47.154.158.103 -> zcydsf874ha UDP IP fragment ID=3D10796 Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64 2 0.00025 47.154.158.103 -> zcydsf874ha UDP IP fragment ID=3D10796 Offset=3D0 MF=3D1 TOS=3D0x0 TTL=3D64 3 10.00706 47.154.158.103 -> zcydsf874ha UDP IP fragment ID=3D10797 Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64 4 0.00010 47.154.158.103 -> zcydsf874ha UDP IP fragment ID=3D10797 Offset=3D0 MF=3D1 TOS=3D0x0 TTL=3D64 5 6.89527 zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in reassembly) 6 0.00010 zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in reassembly) 7 0.00008 zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in reassembly) I come to consult if IPFilter later version supports automatically reassemble IP fragments, or any solution can help me to resolve such problem? thank you very much! P.S.=20 current IP filter version: bash-3.00# ipf -V ipf: IP Filter: v4.1.9 (592) Kernel: IP Filter: v4.1.9 Running: yes Log Flags: 0 =3D none set Default: pass all, Logging: available Active list: 1 Feature mask: 0x107 Best regards=20 Xiaohong Liu (Susan)=20 Email: [email protected]=20 Tele: +65 6510 7931/ESN 542 7931=20 "The author works for Telfonaktiebolaget L M Ericsson ("Ericsson"), who is solely responsible for this email and its contents. All inquiries regarding this email should be addressed to Ericsson. Nortel has provided the use of the nortel.com domain to Ericsson in connection with this email solely for the purpose of connectivity and Nortel Networks has no liability for the email or its contents. The web site for Ericsson is www.ericsson.com <http://www.ericsson.com/> ." =20 ------_=_NextPart_002_01CB86FA.4DF8EA3D Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE id=3DridTitle>Blank</TITLE> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <STYLE><!-- body { font-family: Arial, Helvetica; font-size: 10pt; = color: #000000; margin-top: 25px; margin-left: 25px; } P.msoNormal, = LI.msoNormal { font-family: Helvetica, "Times New Roman"; font-size: = 10pt; margin-top: 0px; margin-left: 0px; color: "#ffffcc"; } --></STYLE> <META content=3D"MSHTML 6.00.2900.6036" name=3DGENERATOR></HEAD> <BODY id=3DridBody background=3Dcid:092541408@18112010-17F8> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>Hi, = all</FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>I use IP = filter=20 v4.1.9(592) on Solaris 10 U8. </FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>During = testing, I observe=20 that IPFilter will block the fragmented packets out of order when the = server=20 doesn't receive the first segment before any of others. = </FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>Snoop packets = are given as=20 an example as the following: Packet 1 & 3 are dropped. Packet 2 = & 4 are=20 passed, but waiting for the later fragment. As a result of the packets = dropping,=20 ICMP of reassembly time exceeded packets are sent out=20 finally.</FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff> = 1 =20 0.00000 47.154.158.103 -> zcydsf874ha UDP IP fragment = ID=3D10796=20 Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64<BR> 2 0.00025 = 47.154.158.103=20 -> zcydsf874ha UDP IP fragment ID=3D10796 = Offset=3D0 MF=3D1=20 TOS=3D0x0 TTL=3D64<BR> 3 10.00706 47.154.158.103 -> = zcydsf874ha =20 UDP IP fragment ID=3D10797 Offset=3D1480 MF=3D0 TOS=3D0x0 = TTL=3D64<BR> 4 =20 0.00010 47.154.158.103 -> zcydsf874ha UDP IP fragment = ID=3D10797=20 Offset=3D0 MF=3D1 TOS=3D0x0 TTL=3D64<BR> = 5 =20 6.89527 zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in=20 reassembly)<BR> 6 0.00010 zcydsf874ha ->=20 47.154.158.103 ICMP Time exceeded (in reassembly)<BR> = 7 =20 0.00008 zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in=20 reassembly)<BR></FONT></SPAN></P> <P><SPAN class=3D092541408-18112010></SPAN><SPAN = class=3D092541408-18112010><FONT=20 color=3D#0000ff>I come to consult if IPFilter later version supports = automatically=20 reassemble IP fragments, or any solution can help me to resolve such=20 problem?</FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>thank you very = much!</FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>P.S. = </FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>current IP = filter=20 version:</FONT></SPAN></P> <P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>bash-3.00# ipf = -V<BR>ipf:=20 IP Filter: v4.1.9 (592)<BR>Kernel: IP Filter: v4.1.9<BR>Running: = yes<BR>Log=20 Flags: 0 =3D none set<BR>Default: pass all, Logging: available<BR>Active = list:=20 1<BR>Feature mask: 0x107<BR></FONT></SPAN></P><!-- Converted from = text/rtf format --> <P align=3Dleft><STRONG><FONT color=3D#008000><FONT face=3D"Arial = Unicode MS"><SPAN=20 lang=3Den-us><EM>Best regards</EM></SPAN> </FONT></FONT></STRONG></P> <P><FONT color=3D#008000><STRONG><FONT face=3D"Arial Unicode MS"><FONT=20 color=3D#800080><SPAN lang=3Den-us>Xiaohong Liu</SPAN> (Susan) = <BR></FONT><SPAN=20 lang=3Den-us>Email: <U>[email protected]</U></SPAN> <BR><SPAN=20 lang=3Den-us>Tele: +65 6510 7931/ESN 542 7931</SPAN></FONT>=20 </STRONG></FONT></P> <P><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 9pt; COLOR: blue; FONT-FAMILY: Arial; = mso-bidi-font-family: Arial"><EM>“The=20 author works for Telfonaktiebolaget L M Ericsson = (“Ericsson”), who is solely=20 responsible for this email and its contents. All inquiries regarding = this email=20 should be addressed to Ericsson. Nortel has provided the use of the = nortel.com=20 domain to Ericsson in connection with this email solely for the purpose = of=20 connectivity and Nortel Networks has no liability for the email or its = contents.=20 The web site for Ericsson is <B><A title=3Dhttp://www.ericsson.com/=20 href=3D"http://www.ericsson.com/">www.ericsson.com</A></B>.”<?xml:n= amespace prefix=20 =3D o ns =3D "urn:schemas-microsoft-com:office:office"=20 /><o:p></o:p></EM></SPAN></P><BR> <DIV> </DIV></BODY></HTML> ------_=_NextPart_002_01CB86FA.4DF8EA3D-- ------_=_NextPart_001_01CB86FA.4DF8EA3D Content-Type: image/gif; name="Blank Bkgrd.gif" Content-Transfer-Encoding: base64 Content-ID: <092541408@18112010-17F8> Content-Description: Blank Bkgrd.gif Content-Location: Blank%20Bkgrd.gif R0lGODlhLQAtAID/AP////f39ywAAAAALQAtAEACcAxup8vtvxKQsFon6d02898pGkgiYoCm6sq2 7iqWcmzOsmeXeA7uPJd5CYdD2g9oPF58ygqz+XhCG9JpJGmlYrPXGlfr/Yo/VW45e7amp2tou/lW xo/zX513z+Vt+1n/tiX2pxP4NUhy2FM4xtjIUQAAOw== ------_=_NextPart_001_01CB86FA.4DF8EA3D--