UDP Packet reassembly

[Chuck Swiger]

On Jul 28, 2011, at 12:01 PM, Stephen Clark wrote:
> Could someone enlighten me as to when FreeBSD 6.3 does UDP packet reassembly?

Packet reassembly is done at the IP layer, not the UDP layer.  Normally, reassembly is performed on the destination host, but routers or firewalls along the path conceivably might also reassemble packets.

> I am having a problem where I am getting a fragmented udp packet (2 pieces) everthing is
> fine if I get the first frag first. but if the second frag comes first then both fragments get dropped.
> 
> I am using ipfilter and a bimap to redirect these packets to a host inside of the FreeBSD box,
> so I suspicion it is ipfilter causing the drops.
> 
> I know, I know 6.3 is ancient history, but any insight would be appreciated.

It's probably the firewall dropping the traffic, yes-- running tcpdump on the firewall versus the destination host would confirm this.  Something like "keep frags" on your pass rules would help if it is ipfilter...

Regards,
-- 
-Chuck