dropping udp fragments with ipfw

From: mike tancsa <mike_at_sentex.net>
Date: Thu, 29 Aug 2024 18:51:37 UTC
I was working on some firewall rules to drop large UDP fragment attacks 
and noticed there is no easy way to drop fragments based on port ? e.g. 
if someone sends a UDP packet of 1400 bytes, I can drop it with

TARGET=192.168.1.1

ipfw add 5 deny log udp from any 53 to $TARGET

But if that packet is say 2000 bytes and is fragmented, the fragment 
passes through. I have to add a subsequent rule

ipfw add 10 deny log udp from any to $TARGET fragment

But this would kill all UDP fragments.  If the host has some other UDP 
application that needs to deal with fragmented packets, is there a way 
to get around that and only drop packets with a certain port in the 
first fragment ?

     ---Mike