iptables & ebtables

iptables & ebtables

[bend chen]

HI,netfilter-user


I  have some question£¬pleas help me.
1\if I used ebtables process a package,but need iptables can't process THIS package,how can I do?
2\can i use iptables drop some LENGTH package, can I mach : if the package > 128K then DROP?

thanks you help

Re: iptables & ebtables

[Jörg Harmuth]

bend chen wrote:
> HI,netfilter-user
> 
> 
> I  have some question，pleas help me.
> 1\if I used ebtables process a package,but need iptables can't process THIS package,how can I do?

Sorry, I can't parse this sentence

> 2\can i use iptables drop some LENGTH package, can I mach : if the package > 128K then DROP?

Yes. Use the length match, e.g.

iptables -A INPUT -p tcp -m length --length --length 1501: -j DROP

will send all tcp-packets with more than 1500 bytes to nirvana. BTW, 
neither tcp (1500 bytes max) nor udp (65 KBytes max) will ever generate 
packets of the size you mentioned above. ICMP packets are even smaller - 
i don't recall max size at the moment.

HTH,

Joerg

Re: iptables & ebtables

[Henrik Nordstrom]

On Fri, 14 Oct 2005, [UTF-8] Jörg Harmuth wrote:

> will send all tcp-packets with more than 1500 bytes to nirvana. BTW, neither 
> tcp (1500 bytes max) nor udp (65 KBytes max) will ever generate packets of 
> the size you mentioned above. ICMP packets are even smaller - i don't recall 
> max size at the moment.

Both TCP and UDP is limited by the max IP packet size, approx 65KB for 
IPv4.

TCP normally generates small packets <1500, but if you disable Path-MTU 
discovery larger packets may be seen, just as can be seen with UDP.

Regards
Henrik

Re: iptables & ebtables

[bend chen]

Hi,netfilter£¬


Thanks Joerg help.

i wrote:
   If I used ebtables process a package,but need iptables can't process THIS package,how can I do?

this means:
  if i use ebtalbes(http://ebtables.sourceforge.net) manage a package(like a ftp-package),for example: set-mark.
for this package (ftp-package),not need iptables manage this package,how do i do?

Re: iptables & ebtables

[Henrik Nordstrom]

On Sat, 15 Oct 2005, bend chen wrote:

> If I used ebtables process a package,but need iptables can't process THIS package,how can I do?

What kind of packet is it?

If you have set a mark in ebtables then you can look for this mark in 
iptables using the mark match.

Regards
Henrik