Re: NEW vs INVALID

[Anders Fugmann <afu@fugmann.dhs.org>]

Jens Lechtenbörger wrote:
> Hi there,
> 
> using stateful packet matching I wonder how an INVALID tcp packet is
> defined.  In particular, I set up a rule to log inbound NEW ssh
> connections to port 22:
> iptables -A INPUT  -m state --state NEW -p TCP --dport 22 -j LOG --log-level 5 --log-prefix "IPTABLES: Legal NEW TCP: "
> 
> What confuses me, is that this rule not only logs initial SYN
> packets but also (initial) packets with SYN and FIN set. 
> I thought that such packets should be INVALID...
SYN-FIN??? Are you sure of this? I would suspect some ACK-FIN when the 
connection closes, but not SYN-FIN.

Anyhow, AFAIK, the INVALID target only matches  ackets which are 
malformed. a SYN-FIN packets is not malformed as such. (But yes, SYN-FIN 
is an illegal combination, and should be dropped, though this is not the 
purpose of the INVALID match (IMHO, this can easily be done using 
standard netfilter rules).

Regards
Anders Fugmann

-- 
Neo: 'Can you fly that thing?'
Trinity: 'Not yet'.
$ apt-get install pilot-prg-v212helicopter.