-m string --string cmd.exe

[Allen Wayne Best <iptables@atoka-software.com>]

hello:

i read in the linux journal the article "A NATural Progression" about a rule 
which twinked my interest:

iptables -t filter -I FORWARD -m string \
   --string=root.exe -j DROP

this set me to thinking, "ahhhh, a way to stop all those microcosm virii. 
they have the commonality of the string 'cmd.exe.'" so off i go to build a 
rule of similar bent, that is:

iptables -A  INPUT -i $EXTERNAL -p tcp --dport 80 \
    -m string --string=cmd.exe -j DROP

when i try to use this rule, i get the following error:

iptables v1.1.1: Couldn't load match `string'

have i missed something, or do i need to recompile the kernel (please say it 
ain't so.....) fyi, i am using rh 7.0 and rh 7.2 on the servers.

-- 
regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 20:54:8::161:2002

"Gort, klaatu nikto barada."
-- The Day the Earth Stood Still