[157051] in North American Network Operators' Group
Re: Dropping IPv6 Fragments
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Thu Oct 4 11:18:03 2012
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Thu, 4 Oct 2012 15:15:45 +0000
In-Reply-To: <506DA41C.70800@bogus.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Oct 4, 2012, at 9:58 PM, joel jaeggli wrote:
> Likewise with the acl I have the property that the initial packet has=20
> all the info in it while the fragment does not.=20
For iACLs, just filter non-initial fragments directed to infrastructure IPs=
. Cisco & Juniper ACLs have ACL matching criteria for non-initial fragment=
s.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton
