Re: is it possible to block ip packets that contains experimental tcp options ?

[Glenn Terjesen <glenn@webcat.no>]

Thanks allot Pascal,

iptables -A FORWARD -p tcp --tcp-option 76 -j REJECT

seems to be working.


On Mon, 2007-05-21 at 20:27 +0200, Pascal Hambourg wrote:
> Hello,
> 
> Glenn Terjesen a écrit :
> > What i meant with "experimental tcp options" is that my ids (snort)
> > keept logging these "experimental tcp options"
> > 
> > #
> > code 76
> > length 8
> > data 01019DEDBEF00005
> > 
> > I know this aint a snort list, but my servers don't serve any services
> > that require this kind of traffic.
> > 
> > So i was wondering if iptables has any way of blocking these.
> 
> If you have a black list of options you want to drop (or a white list of 
> allowed options), what about the "--tcp-option" option of the "tcp" match ?
> 
> > These to magic lines fixed it all
> > iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP
> > iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
> 
> I wonder how these rules could drop packets according to TCP options. 
> TCP flag combinations are not TCP options.
> 
> 
-- 
Mvh Glenn Terjesen @ Webcat AS
Tlf: +47 37 02 20 20
E-post: support@webcat.no