[Winpcap-users] Udp port filters with IP fragmentation
Ed.Sassone at autonomy.com
Mon Nov 1 07:27:51 PDT 2010
If we have udp port filtering set up, IP fragmented packets past the
first one will not be processed with the rest of the stream.
For example if I have a filter such as udp and (src host 10.20.30.40
and src port 5060) the second packet of a two packet fragmented set will
not be passed. I'm thinking the issue is there is no udp header on the
second packet. If I take the port restriction off then it is ok.
On WinPcap 4.0.2.
If have a trace available if that would help.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Winpcap-users