From: Nemeth Denes <nemeth.denes@iit.bme.hu>
To: netfilter@vger.kernel.org
Subject: sequence numbers in conntrack
Date: Sat, 09 Jan 2010 22:12:38 +0100 [thread overview]
Message-ID: <4B48F146.4040303@iit.bme.hu> (raw)
Hello,
Could someone help me to explain what does the conntack module do
in TCP connection negotiation in the following three cases: (host N is
behind the NAT and host P is on the other side of the NAT)
A:
P sends a SYN to H and H replies with an SYN-ACK with an invalid
sequence number (If this passes normally through is it possible to
filter it out?)
B:
P sends a SYN to H and H replies with non SYN-ACK (3-way-handshake)
or SYN (TCP simultaneous open) package
C: If the "--random" option is given to the postrouting chain, what happens
if the clients use up all the ports?
Many thanks,
Denes Nemeth
next reply other threads:[~2010-01-09 21:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-09 21:12 Nemeth Denes [this message]
2010-01-10 4:10 ` sequence numbers in conntrack vishesh
2010-01-10 10:06 ` Nemeth Denes
2010-01-10 11:03 ` Nemeth Denes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B48F146.4040303@iit.bme.hu \
--to=nemeth.denes@iit.bme.hu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox