From: Arkadiusz Miskiewicz <arekm@pld-linux.org>
To: netfilter@lists.samba.org
Subject: Re: -m string and RELATED
Date: 04 Nov 2002 13:25:37 +0100 [thread overview]
Message-ID: <873cqhttby.fsf@arm.t19.ds.pwr.wroc.pl> (raw)
In-Reply-To: <1036406552.8844.47.camel@elendil>
[-- Attachment #1: Type: text/plain, Size: 838 bytes --]
Cedric Blancher <blancher@cartel-securite.fr> writes:
> I do not see your problem. You want to log packets that :
> . contains string "xyztest"
> AND
> . are NEW, ESTABLISHED or RELATED
>
> The first packet logued matches, but not the second as it does not
> contains string "xyztest".
>
> So, WTF ? :)))
I was thinking about other packets as related to this one with ,,xyztest''
in it because they all come from the same connection.
> If you want to log the whole session that follows a packet containing
> string "xyztest", then it will be a little more tricky. You have to use
> the patch-o-matic CONNMARK patch (extra section) which provides a target
> to set per connection mark, and a connmark match to match against it.
Nice, thanks. That should do it.
> Cédric Blancher <blancher@cartel-securite.fr>
[-- Attachment #2: Type: text/plain, Size: 145 bytes --]
--
Arkadiusz Miśkiewicz CS at FoE, Wroclaw University of Technology
arekm@sse.pl AM2-6BONE, 1024/3DB19BBD, arekm(at)ircnet, PLD/Linux
next prev parent reply other threads:[~2002-11-04 12:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-11-04 10:14 -m string and RELATED Arkadiusz Miskiewicz
2002-11-04 10:42 ` Cedric Blancher
2002-11-04 12:25 ` Arkadiusz Miskiewicz [this message]
2002-11-04 19:04 ` Antony Stone
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=873cqhttby.fsf@arm.t19.ds.pwr.wroc.pl \
--to=arekm@pld-linux.org \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.