Re: is it possible to block ip packets that contains experimental tcp options ?

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Glenn Terjesen a écrit :
> What i meant with "experimental tcp options" is that my ids (snort)
> keept logging these "experimental tcp options"
> 
> #
> code 76
> length 8
> data 01019DEDBEF00005
> 
> I know this aint a snort list, but my servers don't serve any services
> that require this kind of traffic.
> 
> So i was wondering if iptables has any way of blocking these.

If you have a black list of options you want to drop (or a white list of 
allowed options), what about the "--tcp-option" option of the "tcp" match ?

> These to magic lines fixed it all
> iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP
> iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP

I wonder how these rules could drop packets according to TCP options. 
TCP flag combinations are not TCP options.