Detect / Block Traffic that have a large packet size

RouterOS General
1

Guys, good night,
I’m no expert on Mikrotik. I have doubts about this:

Is there any way to detect / block traffic with very large packets? This is good security practice for the firewall, and I’m looking how to do this. Does anyone know how?

Best,

2

In firewall rules, for example, look for “packet size” (2nd tab). It can be one value (ex. 100) or a range of sizes (ex. 1000-1500).

Sent from my cell phone via Tapatalk. Sorry for the errors.

3

How would such packets get to you in the first place? If you block traffic up to your MTU size then you will break legitimate traffic.

4

I did this, it’s in the attached image. That’s right?
I created the same rule for both Input / Forward
In the action menu, I select drop
Captura de Tela 2017-02-16 às 20.40.01.png

5

I want to prevent packets larger than 1500 bytes from overloading my network. I am not an provider, but I use hotspot for my internal clients on the local network.

6

So you’re saying “if it’s not between 0 and 1500 bytes”. It could have been also “1501-0” which means “from 1501 to larger”. Same sh.. different smell :wink:

Sent from my cell phone via Tapatalk. Sorry for the errors.

7

Edit: R1CH may have missed the"!" which stands for “not”. So the rule means anything that’s not between 0-1500 bytes. So, your not breaking your network.

Sent from my cell phone via Tapatalk. Sorry for the errors.

8

I’m saying you’re creating a useless firewall rule. A packet cannot be larger than your MTU, and blocking packets below your MTU will break things.

Perhaps you’re confusing large packets with large pings?