Firewall not match packet fragment

RouterOS General
1

Hi all,

I have a case about firewall rules
My client send Flood attack with UDP Packet Fragments, I’ve created rule firewall which detect amount packet UDP from client (set rule to match Dst.limit Rate 1000 packet/s)
However, when i use Tools>Torch and capture amount packet (interval time is 1s), amount packet captured about >2000/s. But rules Dst.limit Rate 1000 packet/s is not match
And I test again with a rule firewall match accept any packet from client and view counters realtime inline rules, amount packet counters is only <20 packet/s but rate counter realtime is about 50Mbps. While amount packet captured in Tools > Torch is more 2000packet/s (rate is same 50Mbps)

Please let me know the solutions that fix this issue
P/s: I tested check option “Fragment” but still same error
Version RouterOS - 5.18

Thanks all

2

what’s the state of Connection Tracking? AFAIR, ConnTrack defragments packets

3

Connection Tracking is enabled

Thanks
LTL

4

Hi Chupaka, Connection Tracking is enabled.

Thanks

5

I re-read your mssages…

what if in Torch you see fragmented packets, and in Firewall they are already defragmented by ConnTrack? =)

6

Thanks Chupaka,
I saw :slight_smile: