Analysis on the problem of Linux not sending out fragmented packets

Today, there is a network attack simulation needs, to hit the IP packet, the program is written, in the development machine verification is not a problem, and then deployed to the sandbox environment, is not sent out the packet, and non-fragmented packets can be sent normally, the positioning process is as follows

1. Comparing the values of IP-related parameters under the/proc/sys/net/ipv4 of two machines, all the same, ignoring the impact of Ipfrag related settings.

2. View DMESG,/var/log/messages, there are no unusual logs.

3. View Netstat-s

Ip:226610920001Total Packets Received957With Invalid addresses0forwarded0Incoming Packets Discarded226610067704Incoming packets delivered588767879431Requests sent out20609816outgoing packets dropped43646dropped because of missing route thefragments dropped after timeout353567514 reassemblies Required thePacket Reassembles failed

One of the floating red this, according to the rate of 50w/s, roughly know that the kernel has lost the packet, guess the reason is: the kernel set up the reorganization of the packet, waiting to send the subsequent packets, has not waited.

4. The parameters of the network card

Ethtool---k xgbe0 lrf off

5. After the packet can be sent to 10s, the packet will not be sent out again.

6. Consider the kernel-related things, see each kernel module found Nf_defrag_ipv4 module, manually remove all the relevant modules

Rmmod  iptable_nat  nf_natrmmod nf_conntrack_ipv4 nf_conntrack  nf_defrag_ipv4rmmod iptable_filter  Ip_queue nfnetlink iptable_mangle ip_tables x_tables

7. Done

Summary: The problem-solving process does not fully understand the root causes of the various phenomena and the fundamental knowledge involved, need to continue to supplement

Analysis on the problem of Linux not sending out fragmented packets