Re: Shouldn't this rule catch all packets

[jwlargent <jwlargent@vlsmaps.com>]

Petr Pisar wrote:
> On 2006-12-14, jwlargent <jwlargent@vlsmaps.com> wrote:
>   
>> I was trying to debug some errors in my iptables setup so I added the 
>> following rules to my OUTPUT, just to see what packets were going out.
>>
>> iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
>> iptables -A OUTPUT -j ACCEPT
>>
>> When I do iptables -L OUTPUT -v it shows some packets are falling 
>> through to the last rule.
>> Shouldn't the first rule catch all the packets?
>>
>>     
> No. There exists forth state called INVALID. E.g. TCP packet with ACK
> witch is not part of any tracked TCP connection is INVALID. Naturally,
> INVALID packets are ill packets and they shoudn't appear, but the reality
> is different.
>
> -- Petr
>
>   
So I put in a log rule for --state INVALID and sure enough thats what it 
was.
The packets are part of my ssh connection, tcp with ACK.

IN= OUT=eth0 SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=276 TOS=0x10 
PREC=0x00 TTL=64 ID=1146 DF PROTO=TCP SPT=22 DPT=38858 WINDOW=3228 
RES=0x00 ACK PSH URGP=0