* question about --tcp-flags @ 2004-12-02 22:08 Lopsch 2004-12-02 23:11 ` Jason Opperisano 0 siblings, 1 reply; 6+ messages in thread From: Lopsch @ 2004-12-02 22:08 UTC (permalink / raw) To: Netfilter-Mailinglist [-- Attachment #1: Type: text/plain, Size: 638 bytes --] I only want to know how iptables uses this option. For example --tpc-flags SYN,ACK,RST SYN how is it then used? Am I right that the flags SYN,ACK,RST are inspected and only the SYN flag is allowed to be set? Or is it so that SYN,ACK,RST are inspected and the SYN flag must be set but the other are optional so that all can be set but only SYN has to be set? I´m a little confused :). And another question what flags cobos are allowed/not allowed. I only know about a few so SYN,RST set is an illegal set also SYN,FIN. Or SYN,ACK when initiating a connection. Thank´s in advance for replies. -- PGP-ID 0xF8EAF138 [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 825 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: question about --tcp-flags 2004-12-02 22:08 question about --tcp-flags Lopsch @ 2004-12-02 23:11 ` Jason Opperisano 2004-12-02 22:34 ` Lopsch 0 siblings, 1 reply; 6+ messages in thread From: Jason Opperisano @ 2004-12-02 23:11 UTC (permalink / raw) To: Netfilter-Mailinglist On Thu, Dec 02, 2004 at 11:08:21PM +0100, Lopsch wrote: > I only want to know how iptables uses this option. For example > --tpc-flags SYN,ACK,RST SYN how is it then used? Am I right that the > flags SYN,ACK,RST are inspected and only the SYN flag is allowed to be > set? yes. "--tcp-flags SYN,ACK,RST SYN" means: out of the flags SYN, ACK, RST: SYN is set ACK is not set RST is not set the flags FIN, URG, PSH are not examined and may be either set or not set. > Or is it so that SYN,ACK,RST are inspected and the SYN flag must be > set but the other are optional so that all can be set but only SYN has > to be set? I´m a little confused :). And another question what flags > cobos are allowed/not allowed. I only know about a few so SYN,RST set is > an illegal set also SYN,FIN. Or SYN,ACK when initiating a connection. i've seen this list pop up here and there: http://www.stearns.org/modwall/sample/tcpchk-sample seems pretty complete to me. the most common ones you see people creating DROP rules for are: ALL ALL ALL NONE SYN,FIN SYN,FIN ALL FIN,URG,PSH SYN,RST SYN,RST FIN,RST FIN,RST FIN,ACK FIN -j -- "I have been shot eight times this year, and as a result, I almost missed work." --The Simpsons ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: question about --tcp-flags 2004-12-02 23:11 ` Jason Opperisano @ 2004-12-02 22:34 ` Lopsch 2004-12-02 23:08 ` Jason Opperisano 0 siblings, 1 reply; 6+ messages in thread From: Lopsch @ 2004-12-02 22:34 UTC (permalink / raw) To: Netfilter-Mailinglist [-- Attachment #1: Type: text/plain, Size: 506 bytes --] Jason Opperisano schrieb: > i've seen this list pop up here and there: > > http://www.stearns.org/modwall/sample/tcpchk-sample > > seems pretty complete to me. > > the most common ones you see people creating DROP rules for are: > > ALL ALL > ALL NONE > SYN,FIN SYN,FIN > ALL FIN,URG,PSH > SYN,RST SYN,RST > FIN,RST FIN,RST > FIN,ACK FIN > > -j > > -- Thank´s will take look at that list :). But a last question. --syn is the same as --tcp-flags ALL SYN? [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 825 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: question about --tcp-flags 2004-12-02 22:34 ` Lopsch @ 2004-12-02 23:08 ` Jason Opperisano 2004-12-02 23:44 ` Lopsch 0 siblings, 1 reply; 6+ messages in thread From: Jason Opperisano @ 2004-12-02 23:08 UTC (permalink / raw) To: netfilter On Thu, 2004-12-02 at 17:34, Lopsch wrote: > Thank´s will take look at that list :). But a last question. --syn is > the same as --tcp-flags ALL SYN? no. "--syn" is the example you asked about: --tcp-flags SYN,RST,ACK SYN this is clearly explained in 'man iptables' btw... -j -- "Fame was like a drug. But what was even more like a drug were the drugs." --The Simpsons ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: question about --tcp-flags 2004-12-02 23:08 ` Jason Opperisano @ 2004-12-02 23:44 ` Lopsch 2004-12-02 23:57 ` Jason Opperisano 0 siblings, 1 reply; 6+ messages in thread From: Lopsch @ 2004-12-02 23:44 UTC (permalink / raw) To: Netfilter-Mailinglist [-- Attachment #1: Type: text/plain, Size: 890 bytes --] Jason Opperisano schrieb: > On Thu, 2004-12-02 at 17:34, Lopsch wrote: > >>Thank´s will take look at that list :). But a last question. --syn is >>the same as --tcp-flags ALL SYN? > > > no. "--syn" is the example you asked about: > > --tcp-flags SYN,RST,ACK SYN > > this is clearly explained in 'man iptables' btw... > > -j > > -- > "Fame was like a drug. But what was even more like a drug were > the drugs." > --The Simpsons Yes I know but the manpages don´t work here don´t know why. Hmm but then it´s better to explicit drop packets like ... --tcp-flags SYN,FIN SYN,FIN before using a line like this ... --syn -m state --state NEW ... because this would also allow the usage of SYN,FIN for new connections. And that´s not a legal set. Or isn´t it necessary to drop those packets because TCP will take care of that and send RST for them? [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 825 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: question about --tcp-flags 2004-12-02 23:44 ` Lopsch @ 2004-12-02 23:57 ` Jason Opperisano 0 siblings, 0 replies; 6+ messages in thread From: Jason Opperisano @ 2004-12-02 23:57 UTC (permalink / raw) To: netfilter On Thu, 2004-12-02 at 18:44, Lopsch wrote: > Yes I know but the manpages don´t work here don´t know why. you may want to look into that... > Hmm but then > it´s better to explicit drop packets like ... --tcp-flags SYN,FIN > SYN,FIN before using a line like this ... --syn -m state --state NEW ... > because this would also allow the usage of SYN,FIN for new connections. yeah--if you want to drop flag combinations, you would normally do that first, before accepting any connections. > And that´s not a legal set. Or isn´t it necessary to drop those packets > because TCP will take care of that and send RST for them? no. the point is not to allow TCP to do its thing--that's how scanners like nmap work, by processing a host's response to weird flag combinations... -j -- "When I grow up, I'm going to Bovine University!" --The Simpsons ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-12-02 23:57 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2004-12-02 22:08 question about --tcp-flags Lopsch 2004-12-02 23:11 ` Jason Opperisano 2004-12-02 22:34 ` Lopsch 2004-12-02 23:08 ` Jason Opperisano 2004-12-02 23:44 ` Lopsch 2004-12-02 23:57 ` Jason Opperisano
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.