string match fails to find anything/everything

string match fails to find anything/everything

[gypsy]

Facts:
iptables 1.2.9 built against kernel v 2.4.25 or .26 depending on which
computer.
kernel 2.4.26
os fingerprinting only works on the internal interface,  not eth1.
"tcpdump -n -i eth1 -w /tmp/dump" clearly shows the text I am attempting
to match.
I have a test bed with very little traffic so that using a string match
will not bog down.
Repeats on 3 different computers all running Slackware 9.1.
Several other POM / POM-NG modules are installed.

Problem:
No matter what text is in $STRING, iptables fails to see the match.

iptables -I INPUT -m string --string $STRING -j LOG

"iptables -nvL | grep STRING" has zeros in the counters.

Example:
Replace $STRING with "oreilly".  From a remote computer run "lynx
http://myurl/oreilly" and variants until at least 30 pages have been
displayed to be certain that at least one packet is not so fragmented
that "oreilly" isn't there (see also Facts above).  On the "myurl"
computer iptables counters are zero.

QUESTION:
How can I find out why the string match fails to find the intended
text?  (Later on I may ask how to fix that...)

gypsy

Re: string match fails to find anything/everything

[Samuel Jean]

 On Sun, 18 Jul 2004, gypsy wrote:
> Problem:
> No matter what text is in $STRING, iptables fails to see the match.
>
> iptables -I INPUT -m string --string $STRING -j LOG

That rule will _only_ apply for packets going to the firewall itself.

>
> "iptables -nvL | grep STRING" has zeros in the counters.
>
> Example:
> Replace $STRING with "oreilly".  From a remote computer run "lynx
> http://myurl/oreilly" and variants until at least 30 pages have been
> displayed to be certain that at least one packet is not so fragmented
> that "oreilly" isn't there (see also Facts above).  On the "myurl"
> computer iptables counters are zero.

Try using that match in the FORWARD chain.

>
> QUESTION:
> How can I find out why the string match fails to find the intended
> text?  (Later on I may ask how to fix that...)
>
> gypsy
>
>
> --__--__--

-- 
Samuel Jean
SysAdmin & NetAdmin
at cookinglinux.org

Re: string match fails to find anything/everything

[Antony Stone]

On Tuesday 20 July 2004 1:52 pm, Samuel Jean wrote:

>  On Sun, 18 Jul 2004, gypsy wrote:
> > Problem:
> > No matter what text is in $STRING, iptables fails to see the match.
> >
> > iptables -I INPUT -m string --string $STRING -j LOG
>
> That rule will _only_ apply for packets going to the firewall itself.

Correct.

> > "iptables -nvL | grep STRING" has zeros in the counters.
> >
> > Example:
> > Replace $STRING with "oreilly".  From a remote computer run "lynx
> > http://myurl/oreilly" and variants until at least 30 pages have been
> > displayed to be certain that at least one packet is not so fragmented
> > that "oreilly" isn't there (see also Facts above).  On the "myurl"
> > computer iptables counters are zero.
>
> Try using that match in the FORWARD chain.

No, I think INPUT is the right one to use here - because the web server is 
running on "myurl", and that is the machine with the netfilter rules (as 
stated in the explanation given above).

Regards,

Antony.

-- 
Abandon hope, all ye who enter here.
You'll feel much better about things once you do.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: string match fails to find anything/everything

[gypsy]

Samuel Jean wrote:
> 
>  On Sun, 18 Jul 2004, gypsy wrote:
> > Problem:
> > No matter what text is in $STRING, iptables fails to see the match.
> >
> > iptables -I INPUT -m string --string $STRING -j LOG
> 
> That rule will _only_ apply for packets going to the firewall itself.

Which is where the request is coming from - not from anybody on my side
of the firewall.  So the FORWARD chain is never going to see the string
I want to log.

Gypsy