bad tcp packets
Hello to everyone
I'm reading "Iptables Tutorial 1.1.19" by Oskar Andreasoon, and I cant understand these bad packets rules
$IPTABLES -N bad_tcp_packets
#
#
# bad_tcp_packets chain # $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \ -m state --state NEW -j REJECT --reject-with tcp-reset $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \ --log-prefix "New not syn:" $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
someone could explain me why that are bad tcp packets?
Thanks
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!
El mar, 23-11-2004 a las 09:18, [email protected] escribió:
Quoted 6 lines
Hello to everyone
I'm reading "Iptables Tutorial 1.1.19" by Oskar Andreasoon, and I cant understand these bad packets rules
Quoted 8 lines
$IPTABLES -N
bad_tcp_packets
#
## bad_tcp_packets chain # $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \ -m state --state NEW -j REJECT --reject-with tcp-reset
May be that you can't got the three flags on, in the same packet
Quoted 6 lines
$IPTABLES -A
bad_tcp_packets-p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not syn:"$IPTABLES -A
bad_tcp_packets-p tcp ! --syn -m state --state NEW -j DROP
May be, if the packet haven't the syn flags on, the packet is not new
Quoted 1 line
someone could explain me why that are bad tcp packets?
I don't secure, but i thing that is this.
regards
Miguel Amador
Quoted 11 lines
Thanks
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti
i nostri servizi!
Quoted 6 lines · On Tue, 2004-11-23 at 07:18, [email protected] wrote:
Hello to everyone
I'm reading "Iptables Tutorial 1.1.19" by Oskar Andreasoon, and I cant understand these bad packets rules
Quoted 8 lines
$IPTABLES -N
bad_tcp_packets
#
## bad_tcp_packets chain # $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \ -m state --state NEW -j REJECT --reject-with tcp-reset
SYN-ACK packets are step 2 in the TCP Three Way Handshake, and are always replies to SYN packets (which are step 1). as a reminder, the TCP Three Way Handshake is:
client server
---------------
SYN ->
<- SYN-ACK
ACK ->
also as a reminder, "-m state --state NEW" packets are packets that do not match an entry in conntrack.
if your are tracking the state of your connections:
"-p tcp -m state --state NEW" packets should only ever be SYN packets (as they come first)
the above rule sends a TCP RST to any SYN-ACK packet that is NEW; i.e, a response to a connection request that we never saw.
Quoted 5 lines
$IPTABLES -A
bad_tcp_packets-p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not syn:"
$IPTABLES -Abad_tcp_packets-p tcp ! --syn -m state --state NEW -j DROP
this drops and logs NEW packets that are anything besides a SYN packet.
-j
--
"I've figured out an alternative to giving up my beer. Basically,
we become a family of traveling acrobats!"
--The Simpsons
* [email protected] <[email protected]> 23. Nov 04:
Quoted 1 line
Hello to everyone
Hi,
Quoted 2 lines
I'm reading "Iptables Tutorial 1.1.19" by Oskar Andreasoon, and I cant understand these bad packets rules
Well choosen. Please, don't wrap commands. I'll fix in quoting.
Quoted 7 lines
$IPTABLES -N
bad_tcp_packets
#
## bad_tcp_packets chain # $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \ -m state --state NEW -j REJECT --reject-with tcp-reset
Conntrack treats a packet as state NEW, if it hits netfilter the first time. The first packet of a TCP stream will never have set both of SYN and ACK. This is the correct answer after a connection request (SYN) from your network, but then it wouldn't be the first packet in stream.
Quoted 2 lines
$IPTABLES -A
bad_tcp_packets-p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not syn:"
Same goes here: NEW in conntrack, but synflag not set should never occure. So LOG...
Quoted 1 line
$IPTABLES -A
bad_tcp_packets-p tcp ! --syn -m state --state NEW -j DROP
... and DROP it.
Quoted 1 line
someone could explain me why that are bad tcp packets?
HTH,
regards, Frank.
Signature · 1 line
Sigmentation fault