IPTables State Tracking

IPTables State Tracking

[Josh.Berry]

Does IPTables track virtual state of ICMP and UDP packets?  I know that
UDP and ICMP are not stateful connections, but does IPTables perform
pseudo-stateful tracking of these connections such as some other
firewalls that basically timeout UDP/ICMP connections after a specific
time?

Thanks,
Josh Berry
Information Security Group
972-856-5402

RE: IPTables State Tracking

[James Mullens]

I believe that a UDP packet that passes through the filters opens a 30
second window for replies.  If a reply comes this is considered to be a
conversation and the window is extended to 180 seconds.  I think the
window is extended as long as the conversation continues.  

For ICMP I believe only types echo, timestamp, info request, and address
can open a 30 second window for a single reply.  The window is closed
when a reply is received.  

This is from netfilter Red Hat 8, kernel 2.4.18.  

Someone who has actually worked on the code may know better.

jim mullens

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of
Josh.Berry@compucom.com
Sent: Friday, August 29, 2003 10:39
To: netfilter@lists.netfilter.org
Subject: IPTables State Tracking


Does IPTables track virtual state of ICMP and UDP packets?  I know that
UDP and ICMP are not stateful connections, but does IPTables perform
pseudo-stateful tracking of these connections such as some other
firewalls that basically timeout UDP/ICMP connections after a specific
time?

Thanks,
Josh Berry
Information Security Group
972-856-5402

Re: IPTables State Tracking

[Chris Brenton]

Greetings Josh,

Josh.Berry@compucom.com wrote:
>
> Does IPTables track virtual state of ICMP and UDP packets? 

That it does.

> I know that
> UDP and ICMP are not stateful connections, but does IPTables perform
> pseudo-stateful tracking of these connections such as some other
> firewalls that basically timeout UDP/ICMP connections after a specific
> time?

ICMP gets a bit more complex than that. You can do this for things like 
Echo-requests, time request, subnet mask requests, etc. as the source 
and destination remains constant. You can also predict the transport and 
type/codes used in the response. This is referred to as traffic that is 
part of a previously "established" session.

When you get into ICMP type 3's and 11's however (host unreachables, TTL 
exceeded, etc.) you get a bit of a problem as the system transmitting 
these packets is usually _not_ the host you sent the original packet to. 
Usually its some router or firewall along the path of the connection. 
Also, the packet type to some extent is unexpected (you transmitted TCP 
or UDP and now you are getting back an ICMP packet from some 
unidentified host).

Both of these packet types store 28 bytes in the payload which 
identifies the original packet that generated the error (like the TCP or 
UDP example above). A good firewall (like iptables) can use this payload 
information to determine if the packet should be allowed through or not.

So these ICMP error packets are not part of the original session, but 
they were generated because of it. For this reason it is referred to as 
"related" traffic.

So the good news is yes, iptables will easily handle established and 
related traffic. The better news is that you have the flexibility to 
handle them independently and do what ever you want with either.

Note that when you are comparing firewalls you really have to look at 
the vendor implementation. For example there are a number of firewalls 
on the market that claim to be based on stateful inspection, and for 
some protocols they actually are, but for type 3's and 11's they fall 
back on rudimentary packet filtering (let them all in including the 
bogus ones, or none at all).

HTH,
C

RE: IPTables State Tracking

[Mark E. Donaldson]

Yes . . . the following is excerpted from the IPTables Tutorial:

"All of the connection tracking is done by special framework within the
kernel called conntrack. Most of the time, we need and want more specific
connection tracking than the default conntrack engine can maintain. Because
of this, there are also more specific parts of conntrack that handles the
TCP, UDP or ICMP protocols among others. These modules grabs specific,
unique, information from the packets, so that they may keep track of each
stream of data. The information that conntrack gathers is then used to tell
conntrack in which state the stream is currently in. For example, UDP
streams are, generally, uniquely identified by their destination IP address,
source IP address, destination port and source port."


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of
Josh.Berry@compucom.com
Sent: Friday, August 29, 2003 7:39 AM
To: netfilter@lists.netfilter.org
Subject: IPTables State Tracking


Does IPTables track virtual state of ICMP and UDP packets?  I know that
UDP and ICMP are not stateful connections, but does IPTables perform
pseudo-stateful tracking of these connections such as some other
firewalls that basically timeout UDP/ICMP connections after a specific
time?

Thanks,
Josh Berry
Information Security Group
972-856-5402