Description

[MX-Series] Invalid IPv4 packet (total length + frag_offset * 8 > 65535) is processed instead of being discarded when fragmented

Solution

Invalid packets which matches the condition (total length + frag_offset * 8 > 65535) is not getting dropped.

There are two possible scenarios here. Assuming the router is transit node, because end nodes anyway drop such packets.

 

i) Transit node and packet doesn't go through further fragmentation.


We will do not take any action on the packet, as we are transit nodes just forward it out

 

ii) Transit node further fragments the invalid packet.

Since the packet is going through further fragmentation, add length check validations and drop the packet, the fix is committed through PR1879908

 


Modification History

2025-08-18 : Article Created