Questions[packets](server)

I'm trying to understand, once a packet reaches the WireGuard interface (wg0) how is it sent to the UDP port from where it can be sent to the receiving peer.

I was reading the WireGuard whitepaper and it says

The interface itself has a private key and a UDP port on which it listens (more on that later), followed by a list of peers

I have only an elementary understanding of networking but I thought processes listen on ports so what does it mean for a network interface to listen on a UDP port?

If there is some way for a network interface to listen to a port, then on the receiving peer, the packet can likewise be received on the WireGuard interface from the UDP port. Is this a correct understanding?

Using iptables is it possible to block fragmented packets with this rule:

iptables -A INPUT -f -j DROP

But there isn't a equivalent in nftables. There is any way to do it?

I just had a problem with our ISP; our internet connection was blocked because there was to much mail being send from our ip. The problem is that we all use gmail and that no mail is being send through the ISP SMTP server as far as we know (ISP blocks all traffic to port 25 if it is not on their server).

I blocked port 25 in advance, so no outgoing mail to that mail server can leave our network. But this does not reject mail send to ports on other servers.

What I would like to do is to find out what is sending those mails on our network. Is there a program that can identify mail packets and reject them using Ubuntu? Our Ubuntu router does not run a smtp server, by the way.

Background

One of our clients suffers from an intermittant problem with their internet where it will drop packets when a user downloads a large file (their IT is looking into the problem).

I have an application consisting of a Web Server running Windows 2008 R2 IIS7.5, and a client running Windows 7, Chrome which uses a long running XMlHttpRequest to transfer "messages" from the server to the client.

The problem.

My application should be should be fairly immune to these packet losses, but in practice it isn't.

I want to test the application under various different network problem scenarios, eg random 1 % packet loss, and bursty packet loss - say complete loss of packets for 4000 ms, and so on.

I'm looking for a solution which lets me "reproduce" a scenario and test my application. I could use 3G, or unplug and unplug the network cable, but the effects are not very reproduceable.

The question.

Is there an application/driver which I can install on my machine to mimick "dodgy" internet connections? Or perhaps an appliance or proxy server I can use in the network to mock these scenarios?

I'm guessing it's not very easy to do on a modern computer because I expect most of the TCP stack is offloaded to the network card, but I would have thought this was a reasonably popular thing to try and do, however I haven't had any luck on google. I'm more proficient on Windows, but a solution which uses Linux, either as a client, or proxy would be welcome.

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is :

Internet Control Message Protocol
    Type: 3 (Destination unreachable)
    Code: 3 (Port unreachable)
    Checksum: 0x811b [correct]
    Internet Protocol, Src: 80.167.113.76 (80.167.113.76), Dst: 192.168.1.2 (192.168.1.2)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 131
        Identification: 0x0631 (1585)
        Flags: 0x00
            0... .... = Reserved bit: Not set
            .0.. .... = Don't fragment: Not set
            ..0. .... = More fragments: Not set
        Fragment offset: 0
        Time to live: 111
        Protocol: UDP (17)
        Header checksum: 0xc19b [correct]
            [Good: True]
            [Bad: False]
        Source: 80.167.113.76 (80.167.113.76)
        Destination: 192.168.1.2 (192.168.1.2)
    User Datagram Protocol, Src Port: 61846 (61846), Dst Port: 25660 (25660)
        Source port: 61846 (61846)
        Destination port: 25660 (25660)
        Length: 111
        Checksum: 0x4b45 [validation disabled]
            [Good Checksum: False]
            [Bad Checksum: False]
    Data (103 bytes)

Data: 64313a6164323a696432303abe916abba14b8cb8a7167ce0...

What is meant by these arbitrary ICMP packets? I am afraid of rootkit. Kindly help.

operating system : windows 7 ultimate