`iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP`

(Taken from https://aws.amazon.com/security/security-bulletins/2026-160-...)

You can also use the following Suricata rule if your network firewall supports it:

`drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`