[LARTC] ACK matching

[LARTC] ACK matching

[Hannes Ebner]

Hi,

in the LARTC-HowTo is an example given for matching packets with the
ACK-bit set.

Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the
HowTo) mean that you are just matching Packets with an ACK set but
without any data? If I am right, this would mean that just
Forward-Acknowledgements are matched, isn't it?

What about matching ACKs with iptables, is it possible to mark Packets
with ACK set but without data?


bye,
Hannes

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ACK matching

[Thomas Graf]

hi

* he@fli4l.de wrote:
> in the LARTC-HowTo is an example given for matching packets with the
> ACK-bit set.
> 
> Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the
> HowTo) mean that you are just matching Packets with an ACK set but
> without any data? If I am right, this would mean that just
> Forward-Acknowledgements are matched, isn't it?

>tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \
>   match ip protocol 6 0xff \

matches tcp

>   match u8 0x05 0x0f at 0 \

matches packets with IHL = 5 -> no ip options

>   match u16 0x0000 0xffc0 at 2 \

matches packets smaller than 64 byte. now we have
14 byte ethernet + 20 byte ip + ~20 bytes tcp header
makes 56 byte headers, so there is not much free space
for payload

>  match u8 0x10 0xff at 33 \

matches the ACK bit

>   flowid 1:10

now, cause almost all packets have the ACK bit set this rule
matches all small packets with no ip options. it could be
done better with nexthdr to match packets with ip options
set too.

> What about matching ACKs with iptables, is it possible to mark Packets
> with ACK set but without data?

Doesnt make much sense, because every packet except a few during
handshake at begin and end have the ACK bit set. Actually, packets
with only ACK set and no payload are rare.

-- 
Thomas Graf
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ACK matching

[Hannes Ebner]

Thanks for your explanation!

Thomas Graf wrote:
> now, cause almost all packets have the ACK bit set this rule
> matches all small packets with no ip options. it could be
> done better with nexthdr to match packets with ip options
> set too.

Wouldn't it also be necessary to match the packets with ACK set + Data 
or aren't they as much important as the packets we are already matching?

bye,
Hannes

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ACK matching

[Thomas Graf]

Hi

* he@fli4l.de wrote:
> Thomas Graf wrote:
> >now, cause almost all packets have the ACK bit set this rule
> >matches all small packets with no ip options. it could be
> >done better with nexthdr to match packets with ip options
> >set too.
> 
> Wouldn't it also be necessary to match the packets with ACK set + Data 
> or aren't they as much important as the packets we are already matching?

	Read about biggy packing, most ACKs are sent within a data
packet to avoid too much overhead, further all data packets in a
transaction have the ACK bit set. You might want to look for a
more practical explanation about TCP than most books provide.

	To quote myself:
now, cause almost all packets have the ACK bit set this rule
matches all small packets with no ip options.

	I never tested if this rule actually improves anything, if
you do please let me know. I think it really depens on what kind
of protocols you use and the average use of your line.

	The match for 5 WORDS ip header len is not really needed because
you could match the ACK bit with help of the nexthdr feature w/o
taking care of possible ip options.

Hope that helps.

-- 
Thomas Graf
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/