Re: bad frag bits

[Matt Kettler <mkettler () evi-inc com>]

At 04:00 PM 11/24/2003, Samuel C. Adams wrote:
> Usually these udp packets are fairly large and it's possible they have
> to travel over a link with low MTU at some point. Is it possible to fragment
> packets if the don't fragment bit is set?

Yes it's possible.. it's not RFC compliant, but it is possible.

> Are there routers out there that do that?

Yes.


> I thought routers were supposed to send ICMP code 3 type 4 messages
> (Fragmentation Needed and Don't Fragment was Set) if they are forced to
> deal with packets out that are too large. Is that not always the case?

No it's not always the case.. there are a lot of broken IP stacks out there. 



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users