IPtables l7 string

IPtables l7 string

[Stephan Higuti]

Hello, anybody can help me with this:

osiris:~# iptables -t filter -A FORWARD -m string --string "orkut" -j DROP
iptables v1.3.4: STRING match: You must specify `--algo'
Try `iptables -h' or 'iptables --help' for more information.

--algo?

What's?

Best Regards

Stephan

-- 
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti.sam@gmail.com
---------------------------------------------------------------------

Re: IPtables l7 string

[Ethy H. Brito]

On Thu, 12 Apr 2007 01:39:53 -0300
"Stephan Higuti" <higuti.sam@gmail.com> wrote:

> Hello, anybody can help me with this:
> 
> osiris:~# iptables -t filter -A FORWARD -m string --string "orkut" -j DROP
> iptables v1.3.4: STRING match: You must specify `--algo'

from iptables man page:

--algo  bm|kmp
           Select the pattern matching strategy. (bm = Boyer-Moore,
             kmp  = Knuth-Pratt-Morris)

Ethy

Re: IPtables l7 string

[Pablo Neira Ayuso]

Stephan Higuti wrote:
> Hello, anybody can help me with this:
> 
> osiris:~# iptables -t filter -A FORWARD -m string --string "orkut" -j DROP
> iptables v1.3.4: STRING match: You must specify `--algo'
> Try `iptables -h' or 'iptables --help' for more information.
> 
> --algo?
> 
> What's?

$ man iptables

--algo bm|kmp
Select the pattern matching strategy. (bm = Boyer-Moore, kmp = 
Knuth-Pratt-Morris)

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Re: IPtables l7 string

[Stephan Higuti]

> from iptables man page:
>
> --algo  bm|kmp
>            Select the pattern matching strategy. (bm = Boyer-Moore,
>              kmp  = Knuth-Pratt-Morris)
>
> Ethy

So, should i use --algo bm or --algo kmp right?
Wich is better?

-- 
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti.sam@gmail.com
---------------------------------------------------------------------

Re: IPtables l7 string

[Ethy H. Brito]

On Thu, 12 Apr 2007 13:12:22 -0300
"Stephan Higuti" <higuti.sam@gmail.com> wrote:

> > from iptables man page:
> >
> > --algo  bm|kmp
> >            Select the pattern matching strategy. (bm = Boyer-Moore,
> >              kmp  = Knuth-Pratt-Morris)
> >
> > Ethy
> 
> So, should i use --algo bm or --algo kmp right?
> Wich is better?

Depends on what you are triyng to achieve.
Take some time to read the first lines from lib/ts_bm.c and lib/ts_kmp.c
under kernel tree. 
The answer is there (I think!).

Ethy