TCP flags

TCP flags

[Jet]

Helo,

Can anyone just explain what is this means?

iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I don't quite understand why there is a white space between SYN,FIN and
SYN,FIN.

.//Jet

Re: TCP flags

[Maciej Soltysiak]

Hello,

> Can anyone just explain what is this means?
>
> iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
>
> I don't quite understand why there is a white space between SYN,FIN and
> SYN,FIN.
iptables -p tcp --help
explains that it is:
 --tcp-flags [!] mask comp   match when TCP flags & mask == comp
                             (Flags: SYN ACK FIN RST URG PSH ALL NONE)

So if we want tcp packets having only SYN and FIN set, and no other flags,
we need the packets flags & SYN|FIN == SYN|FIN.

Where & means a logical AND.
Example.
IF a packet comes with SYN|ACK|FIN flags set, we logically AND it with
SYN|FIN (mask), we get SYN|FIN, and thus we get a match with SYN|FIN (comp)


Regards,
Maciej Soltysiak

Re: TCP flags

[Mark Vevers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 06 Nov 2002 08:03, Jet wrote:
> Can anyone just explain what is this means?
>
> iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
>
> I don't quite understand why there is a white space between SYN,FIN and
> SYN,FIN.
Yup - it means inspect the SYN and FIN flags and if they are both set drop the 
packet.  i.e. just look at the SYN and FIN flags - don't worry about any 
others when doing the test to see if the rule matches.

The first pair are the flags to inspect, the second pair (after the space) are 
the state of the flags to test.

Mark
- -- 
Mark Vevers.    mark@ifl.net / mark@vevers.net
Principal Internet Engineer, Internet for Learning,
Research Machines Plc. (AS5503)
- --
GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB08F3CA3
Fingerprint: 85BA 30C4 9EC8 1792 4C8C   C31E 58B5 3D1C B08F 3CA3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9yQtLWLU9HLCPPKMRAp8iAKCKQP6xrcuvP6UfglVcf0dl2owthwCfcKpU
7tz1W4J2UBkGvYH/dMTsZWU=
=FNMb
-----END PGP SIGNATURE-----

TCP Flags

[zippo]

Hi all!

I need if anyone can send me a list with all the invalid combinations of
TCP flags.

Thx. :)

Re: TCP Flags

[Antony Stone]

On Tuesday 23 December 2003 3:05 pm, zippo wrote:

> Hi all!
>
> I need if anyone can send me a list with all the invalid combinations of
> TCP flags.

Try http://www.securityfocus.com/infocus/1200

Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.