[Winpcap-users] Udp port filters with IP fragmentation

[Sassone, Ed]

If we have udp port filtering set up, IP fragmented packets past the
first one will not be processed with the rest of the stream.

 

For example if I have a filter such as  udp and (src host 10.20.30.40
and src port 5060) the second packet of a two packet fragmented set will
not be passed.  I'm thinking the issue is there is no udp header on the
second packet.   If I take the port restriction off then it is ok.

 

On WinPcap 4.0.2.

 

If have a trace available if that would help.

 

Ed Sassone

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20101101/855d717a/attachment.htm