* --state NEW -j DROP (would be great)
@ 2005-10-26 5:37 Sylvan Andrew
2005-10-26 5:47 ` Henrik Nordstrom
2005-10-26 5:58 ` Aseem Rastogi
0 siblings, 2 replies; 3+ messages in thread
From: Sylvan Andrew @ 2005-10-26 5:37 UTC (permalink / raw)
To: netfilter
Hello,
Could somebody please explain the 'iptables -A INPUT -eth0 -m
state --state NEW -j DROP' a bit more for me ? I understand that it won't
allow any outside initiated inbound connections into a network. However
occasionally if I'm doing a tcpdump we see things like:
21:04:48.935367 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935447 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935455 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935537 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935545 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935629 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935637 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935812 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.935821 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.936045 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.936053 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
21:04:48.936153 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
win 0
What is that and shouldn't it be dropped ? Or is the : R 0:0(0) ack 1 win 0
part of it a already establish connection ? Although that's one of our IP's
it's not active on our network.
Any ideas / advice would be greatly appreciated !
Regards
Sylvan
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: --state NEW -j DROP (would be great)
2005-10-26 5:37 --state NEW -j DROP (would be great) Sylvan Andrew
@ 2005-10-26 5:47 ` Henrik Nordstrom
2005-10-26 5:58 ` Aseem Rastogi
1 sibling, 0 replies; 3+ messages in thread
From: Henrik Nordstrom @ 2005-10-26 5:47 UTC (permalink / raw)
To: Sylvan Andrew; +Cc: netfilter
On Wed, 26 Oct 2005, Sylvan Andrew wrote:
> Hello,
>
> Could somebody please explain the 'iptables -A INPUT -eth0 -m state --state
> NEW -j DROP' a bit more for me ? I understand that it won't allow any
> outside initiated inbound connections into a network.
Correct.
> However occasionally if
> I'm doing a tcpdump we see things like:
>
> 21:04:48.935367 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0) ack 1
> win 0
These are INVALID, not part of any connection.
So if you use
-i eth0 -m state --state NEW,INVALID -j DROP
you should see the expected result..
Regards
Henrik
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: --state NEW -j DROP (would be great)
2005-10-26 5:37 --state NEW -j DROP (would be great) Sylvan Andrew
2005-10-26 5:47 ` Henrik Nordstrom
@ 2005-10-26 5:58 ` Aseem Rastogi
1 sibling, 0 replies; 3+ messages in thread
From: Aseem Rastogi @ 2005-10-26 5:58 UTC (permalink / raw)
To: Sylvan Andrew; +Cc: netfilter
i think tcpdump is packet dump at L2 and iptable rules are applied at
L3. thats why you see these packets but they are dropped at L3.
Sylvan Andrew wrote:
> Hello,
>
> Could somebody please explain the 'iptables -A INPUT -eth0 -m state
> --state NEW -j DROP' a bit more for me ? I understand that it won't
> allow any outside initiated inbound connections into a network.
> However occasionally if I'm doing a tcpdump we see things like:
>
> 21:04:48.935367 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935447 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935455 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935537 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935545 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935629 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935637 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935812 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935821 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936045 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936053 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936153 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
>
> What is that and shouldn't it be dropped ? Or is the : R 0:0(0) ack 1
> win 0 part of it a already establish connection ? Although that's one
> of our IP's it's not active on our network.
>
> Any ideas / advice would be greatly appreciated !
>
> Regards
>
> Sylvan
>
>
--
The end is always good. If it's not good, it's not the end.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-10-26 5:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-10-26 5:37 --state NEW -j DROP (would be great) Sylvan Andrew
2005-10-26 5:47 ` Henrik Nordstrom
2005-10-26 5:58 ` Aseem Rastogi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.