00:00:40.283608 IP (tos 0x0, ttl 116, id 49680, offset 0, flags [none], proto UDP (17), length 32)
ip > ip: UDP, length 4
0x0000: 4500 0020 c21a 0000 6f11 1a1e 902b 4cdb E.......o....+L.
0x0010: ------ 000c c12f 0870 ac49 .....0.(.../.p.I
0x0020: 0000 0000 0000 0000 0000 **2664 94d4** ..........&d..
How drop with iptables "2664 94d4" this on packet?
-I INPUT -p udp --dport 7777 -m string --algo bm --from 28 --hex-string 266494d4 -j DROP
Doesn’t work.
It makes sense that iptables does not filter on those bytes because they are not part of the IP packet.
That packet is shorter than the minimum frame length of Ethernet. So 14 bytes of padding was needed to form a valid Ethernet frame. The sequence 0000 0000 0000 0000 0000 2664 94d4 is padding. It seems reasonable that this part is stripped off the packet before iptables starts filtering it.
The UDP payload is only 4 bytes, as is also indicated by your output. The payload is 0870 ac49.
I am not sure if the standard specifies how Ethernet frames are to be padded. I would have expected the padding to be all NUL bytes. But the last four bytes of padding are not NUL. There may actually be an information leak on the device, which was sending that Ethernet frame.
