|
|
|
@ -273,7 +273,7 @@ Fakes are separate generated by nfqws packets carrying false information for DPI |
|
|
|
`nfqws` cannot redistribute data between original TCP segments. The error displayed is 'message too long'. |
|
|
|
* **badsum** doesn't work if your device is behind NAT which does not pass invalid packets. |
|
|
|
The most common Linux NAT router configuration does not pass them. Most home routers are Linux based. |
|
|
|
The default sysctl configuration `net.netfilter.nf_conntrack_checksum=1` causes contrack to verify tcp and udp checksums |
|
|
|
The default sysctl configuration `net.netfilter.nf_conntrack_checksum=1` causes conntrack to verify tcp and udp checksums |
|
|
|
and set INVALID state for packets with invalid checksum. |
|
|
|
Typically, iptables rules include a rule for dropping packets with INVALID state in the FORWARD chain. |
|
|
|
The combination of these factors does not allow badsum packets to pass through the router. |
|
|
|
|