length match problem

length match problem

[Jackfritt]

Ok I have the following problem.

iptables -A OUTPUT -o ppp0 -p tcp -m length --length :40 -j MARK 
--set-mark 10

That should mark all ACK's or not ?

When I try to do this I get the error:

iptables: Invalid argument

I found out that this has something to do with the length match.
Because not used I don't get an error message. I looked around and found 
an example in netfilter-extensions-HOWTO with icmp:

iptables -A INPUT -p icmp --icmp-type echo-request -m length --length 
86:0xffff -j DROP

When I try to do something like this it doesn't work too :(

So now my question is what am I doin wrong ?

Sorry I'm not an iptables guy an I only tried a script from somewhere 
else. But this one line doesn't work.

anyone can help me ?


Thx


Joerg Esser

Re: length match problem

[Fabrice MARIE]

Hello Joerg,

On Thursday 09 January 2003 06:14, Jackfritt wrote:
> Ok I have the following problem.
> iptables -A OUTPUT -o ppp0 -p tcp -m length --length :40 -j MARK --set-mark 10
> That should mark all ACK's or not ?
> When I try to do this I get the error:
> iptables: Invalid argument
> [...]
> So now my question is what am I doin wrong ?

Typically when the only error message from iptables
is 'Invalid Argument', the actual error message would
be most of the time in the kernel log.
i.e. If I run your command above, it tells me

# dmesg
MARK: can only be called from "mangle" table, not "filter"

So, you should be using a -t mangle in front..

Have a nice day,

Fabrice.
--
Fabrice MARIE

"Silly hacker, root is for administrators"
       -Unknown

Re: length match problem

[Jörg Esser]

Fabrice MARIE wrote:

>Hello Joerg,
>
>On Thursday 09 January 2003 06:14, Jackfritt wrote:
>  
>
>>Ok I have the following problem.
>>iptables -A OUTPUT -o ppp0 -p tcp -m length --length :40 -j MARK --set-mark 10
>>That should mark all ACK's or not ?
>>When I try to do this I get the error:
>>iptables: Invalid argument
>>[...]
>>So now my question is what am I doin wrong ?
>>    
>>
>
>Typically when the only error message from iptables
>is 'Invalid Argument', the actual error message would
>be most of the time in the kernel log.
>i.e. If I run your command above, it tells me
>
># dmesg
>MARK: can only be called from "mangle" table, not "filter"
>  
>
Hmm forget to look there (Just a newbie ;)

>So, you should be using a -t mangle in front..
>  
>
Thx that did it.

>Have a nice day,
>  
>
You too.