Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It exist a solution on packetfilter for doing scrub. I search the same thing on netfilter.

("Scrubbing" is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations.).

Exist it an equivalent solution on netfilter ?

share|improve this question
up vote 0 down vote accepted

No exact equivalent of scrub from BSD's packetfilter (pf) exists in Linux's netfilter (iptables). However, much of what pf's scrub can do can also be done with iptables, with the notable exceptions of some fragment operations (crop and reassemble) and stateful TCP connection normalizations (reassemble tcp).

share|improve this answer
it don't exist an equivalent of the bsd's command "scrub in all" on iptables? – user59331 Nov 5 '10 at 22:24
That is correct. – Steven Monday Nov 5 '10 at 22:56
Ok, and nothing can do a similar thing or a part of this? On what correspond the option -f (fragment) on netfilter? – user59331 Nov 7 '10 at 15:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.