[Winpcap-users] Udp port filters with IP fragmentation

Sassone, Ed Ed.Sassone at autonomy.com
Mon Nov 1 07:27:51 PDT 2010

If we have udp port filtering set up, IP fragmented packets past the
first one will not be processed with the rest of the stream.


For example if I have a filter such as  udp and (src host
and src port 5060) the second packet of a two packet fragmented set will
not be passed.  I'm thinking the issue is there is no udp header on the
second packet.   If I take the port restriction off then it is ok.


On WinPcap 4.0.2.


If have a trace available if that would help.


Ed Sassone


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20101101/855d717a/attachment.htm 

More information about the Winpcap-users mailing list