How to drop packets based on length?

Question

could someone help to make iptables to drop all the packets with length 1006?

Example: 18:33:18.964261 IP 74.209.87.132.3054 > 126.220.67.183.13806: UDP, length 1006

Answer 1

You should use the length match. It supports the range of length.

To drop all udp packets with length 1006 bytes:

iptables -I INPUT -p udp -m length --length 1006 -j DROP

P.S.

1. The iptables -m length --help shows the brief help of the length match.
2. Read the iptables tutorial to understand of the basics.
3. Other rules and order of the rules are very important.
4. Better use the iptables-apply to safe change of the rule set (read the man).
5. To troubleshoot check the rule counters.
6. The tcpdump captures incoming packets before the iptables.