Do
sudo tcpdump --immediate-mode -p -nn -i eth0 -vvv -c 1 'ip and (ip[0] & 0x0f > 5)'
to see if you even get them from upstream.
You can even ping it from outside with these packets in the meantime
ping -R -c 3 $IP
Do
sudo tcpdump --immediate-mode -p -nn -i eth0 -vvv -c 1 'ip and (ip[0] & 0x0f > 5)'
to see if you even get them from upstream.
You can even ping it from outside with these packets in the meantime
ping -R -c 3 $IP
One can also monitor for it in nftables. This is from my raw table:
Once confident nothing legit would be blocked by dropping the packets one can change "log prefix "CVE-2026-98432: " level debug" to "drop" if on an unpatched kernel.$ADDR4 in my case in my internet facing interface.