I am trying to prevent my system from DoS attacks. The first thing i am trying to do is to prevent my system from fragmented ICMP packets.
To do the same i have installed the following rule:
iptables -A INPUT -p icmp -f -j DROP
With the above rule, i don't see anything happening. Still i am able to receive echo-responses for echo requests that i sent with size as 5000.
I saw the iptables statistics and i see the rule is not getting hit at all.
[root@myPc ~]# iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP icmp -f * * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Then i slightly modified the rule as :
iptables -A INPUT -p icmp ! -f -j DROP
With the above rule, all ICMP echo-requests(both fragmented and non-fragmented) are getting dropped. I am not able to ping at all.
[root@myPc ~]# iptables -L -v -n
Chain INPUT (policy ACCEPT 17 packets, 1132 bytes)
pkts bytes target prot opt in out source destination
4 10224 DROP icmp !f * * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 9 packets, 798 bytes)
pkts bytes target prot opt in out source destination

For any ICMP packets, the drop counter is incremented by 1. Which means in case of fragmented packets only the first packet matches the rule and gets dropped.

Please help me in understanding the behavior.

Instead of using "-j DROP" try using a "-j LOG" rule first to "debug" what that rule would do. Easiest, quickest way to start debugging rule sets.

Hi unSpawn,

Thank you for your suggestion.
The main problem i face is my rule is not getting correctly match(pls see in the iptables statistics that i have mentioned).
As the rule is not getting matched, even if give log option is specified no entries is getting logged.

Regards,
Singi21007

See if this matches anything:
else try using the "connbytes" module (see 'iptables -m connbytes --help')?

*Do realize though a fragmentation attack doesn't necessarily require overly large packets: it can also be about many packets very small in size that only cause problems when reassembly starts. While the kernel and the Netfilter framework are very good at detecting, and at time correcting, anomalies an IDS like Snort may be of more help because of its IP defragmentation preprocessor.