Because you said "defragment all packets" yes. In that mode it defragments
them and explodes before it firewalls.
Normally this is rational. Assembling the frame first allows a firewall
module to make more complex decisions and do things like context
analysis of NFS frames for example.
Alan