Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It exist a solution on packetfilter for doing scrub. I search the same thing on netfilter.

("Scrubbing" is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations.).

Exist it an equivalent solution on netfilter ?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

No exact equivalent of scrub from BSD's packetfilter (pf) exists in Linux's netfilter (iptables). However, much of what pf's scrub can do can also be done with iptables, with the notable exceptions of some fragment operations (crop and reassemble) and stateful TCP connection normalizations (reassemble tcp).

share|improve this answer
    
it don't exist an equivalent of the bsd's command "scrub in all" on iptables? –  user59331 Nov 5 '10 at 22:24
    
That is correct. –  Steven Monday Nov 5 '10 at 22:56
    
Ok, and nothing can do a similar thing or a part of this? On what correspond the option -f (fragment) on netfilter? –  user59331 Nov 7 '10 at 15:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.