Re: Dropping RST of SYN

["Dharmendra.T" <dharmu@nsecure.net>]

[-- Attachment #1: Type: text/plain, Size: 1373 bytes --]

On Thu, 2003-09-04 at 14:43, Ralf Spenneberg wrote:

    Am Don, 2003-09-04 um 10.50 schrieb Atsushi Nakagawa:
    > What iptables table/rule can I use to drop RST (TCP) packets that're in
    > reply to SYN?
    > This is what I want it to do:
    > 
    > -SYN->    [NEW]        -SYN->
    >           [CLOSED]     <-RST-
    >             ^
    >           IF TCP & [NEW]: DROP '<-RST-' & SET [CLOSED]
    Using the current state implementation, AFAIK this is not possible.
    The RST is already an established packet. There is no way to
    differentiate between this RST and a later valid and needed RST packet.
    You can only drop all RST packets
    -m state --state ESTABLISHED -p tcp --tcp-flags RST,ACK RST,ACK -j DROP
    
    Cheers,
    
    Ralf
    -- 
    Ralf Spenneberg
    RHCE, RHCX
    
    Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
    IPsec-Howto				     http://www.ipsec-howto.org
    Honeynet Project Mirror:                     http://honeynet.spenneberg.org
    

Hi,

Blocking the RST packets on the firewall is not recommended. If the
attacker comes to know that the server is dropping RST packets then he
can flood the servers by initiating lacks of connections, which inturn
result closewait state.

-- 
Regards
Dharmendra.T
dharmu@nsecure.net
Linux Security and Admin

[-- Attachment #2: Type: text/html, Size: 3256 bytes --]