How to drop incoming negative DNS responses in Linux? (I want a timeout instead) I'm thinking of creating an iptables rule:
iptables -I INPUT -p udp --sport 53 -m u32 ...
000E start of IP Packet (fixed, at first, I wrote 0010) 0022 start of UDP Packet 002A start of DNS message 002C Flags .... .... .... 0000 = Reply code: No error (0) .... .... .... 0011 = Reply code: No such name (3)
I think the offset for -m u32 is counted from the ip header. Also subtracting 2 to get a 32bit.
$ echo $(( 0x002C - 0x000E - 2 )) 28
The mask for the last 4 bits is 0xF
So the rule should be something like this:
iptables -I INPUT -p udp --sport 53 -m u32 --u32 "28&0xF=3" -j DROP