Re: [LARTC] ACK matching

[Thomas Graf <tgr@reeler.org>]

hi

* he@fli4l.de wrote:
> in the LARTC-HowTo is an example given for matching packets with the
> ACK-bit set.
> 
> Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the
> HowTo) mean that you are just matching Packets with an ACK set but
> without any data? If I am right, this would mean that just
> Forward-Acknowledgements are matched, isn't it?

>tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \
>   match ip protocol 6 0xff \

matches tcp

>   match u8 0x05 0x0f at 0 \

matches packets with IHL = 5 -> no ip options

>   match u16 0x0000 0xffc0 at 2 \

matches packets smaller than 64 byte. now we have
14 byte ethernet + 20 byte ip + ~20 bytes tcp header
makes 56 byte headers, so there is not much free space
for payload

>  match u8 0x10 0xff at 33 \

matches the ACK bit

>   flowid 1:10

now, cause almost all packets have the ACK bit set this rule
matches all small packets with no ip options. it could be
done better with nexthdr to match packets with ip options
set too.

> What about matching ACKs with iptables, is it possible to mark Packets
> with ACK set but without data?

Doesnt make much sense, because every packet except a few during
handshake at begin and end have the ACK bit set. Actually, packets
with only ACK set and no payload are rare.

-- 
Thomas Graf
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/