From: Aseem Rastogi <aseem@india.tejasnetworks.com>
To: Sylvan Andrew <sylvan_nids@norfolk.nf>
Cc: netfilter@lists.netfilter.org
Subject: Re: --state NEW -j DROP (would be great)
Date: Wed, 26 Oct 2005 11:28:51 +0530 [thread overview]
Message-ID: <435F1B1B.1050306@india.tejasnetworks.com> (raw)
In-Reply-To: 001501c5d9ef$62a26c30$0510a8c0@cornerpc
i think tcpdump is packet dump at L2 and iptable rules are applied at
L3. thats why you see these packets but they are dropped at L3.
Sylvan Andrew wrote:
> Hello,
>
> Could somebody please explain the 'iptables -A INPUT -eth0 -m state
> --state NEW -j DROP' a bit more for me ? I understand that it won't
> allow any outside initiated inbound connections into a network.
> However occasionally if I'm doing a tcpdump we see things like:
>
> 21:04:48.935367 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935447 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935455 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935537 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935545 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935629 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935637 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935812 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.935821 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936045 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936053 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
> 21:04:48.936153 IP 82.29.180.221.15378 > 213.17.40.204.4154: R 0:0(0)
> ack 1 win 0
>
> What is that and shouldn't it be dropped ? Or is the : R 0:0(0) ack 1
> win 0 part of it a already establish connection ? Although that's one
> of our IP's it's not active on our network.
>
> Any ideas / advice would be greatly appreciated !
>
> Regards
>
> Sylvan
>
>
--
The end is always good. If it's not good, it's not the end.
prev parent reply other threads:[~2005-10-26 5:47 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-10-26 5:37 --state NEW -j DROP (would be great) Sylvan Andrew
2005-10-26 5:47 ` Henrik Nordstrom
2005-10-26 5:58 ` Aseem Rastogi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=435F1B1B.1050306@india.tejasnetworks.com \
--to=aseem@india.tejasnetworks.com \
--cc=netfilter@lists.netfilter.org \
--cc=sylvan_nids@norfolk.nf \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.