From 85721e4b8285473808815575d34bc0fb3d99b03e Mon Sep 17 00:00:00 2001 From: bol-van Date: Sat, 7 Feb 2026 13:50:55 +0300 Subject: [PATCH] update docs --- docs/manual.en.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/manual.en.md b/docs/manual.en.md index ac8da2e..37fff6c 100644 --- a/docs/manual.en.md +++ b/docs/manual.en.md @@ -2101,6 +2101,8 @@ function reconstruct_dissect(dissect[, reconstruct_opts]) Returns `raw_ip`. All checksums are calculated automatically. L4 checksums are intentionally corrupted if `badsum` is specified in [reconstruct_opts](#standard-reconstruct). +Reconstruction of fragmented IP packets involves special magic. + 1. if the "frag_off" field is present, tcp/udp/icmp headers are ignored, payload contains raw ip payload. Incoming fragmented packets come in this form. nfqws2 does not defragment at the IP layer. But this is very persistently done by Linux systems - in order for a fragment to come to nfqws2, you need to try hard by inserting "notrack" into prerouting or output. Dissects in this form can be reconstructed as is. But preparing them in Lua is extremely inconvenient, since you will have to go through the black magic of working with a binary representation. 2. If the "frag_off" field is absent, fragment reconstruction is performed on the entire packet dissect involving both Lua and C code. Lua code must prepare a dissect of the full packet intended for fragmentation, but fill certain fields as they should appear in the fragment: