Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need a rule to match packets with no options set and/or specific window receiving size set:

IP (tos 0x0, ttl 66, id 9000, offset 0, flags [none], proto TCP (6), length 40) y.y.y.y.11111 > x.x.x.x.http: Flags [S], cksum 0xe425 (correct), seq 1729214256, win 715, length 0

So this packet has win 715, flags [none] -> how could I match such packets?

share|improve this question
    
Are you considering any other options, for e.g: Snort? –  quanta Nov 25 '11 at 6:24

2 Answers 2

Thank you for answers, but I think I found the best solution (best in speed):

iptables -I INPUT -m u32 --u32 "6&0xFF=0x6 && 0>>22&0x3C@12&0xFFFF=0x02CB" -j LOG

The line above ensures that is a TCP packet, then find the IP length and adopts (there is an additional two byte extraction) it to the bytes ones need to compare (in the example 715). In one word everyone could extract/find/compare every bit/byte in the packets with the great module -> u32. For more info: iptables-u32.v0.1

share|improve this answer
    
Yeah, good job, works perfectly –  Shocker Aug 29 at 21:25

Iptables has options to deal with TCP flags and TCP options, namely --tcp-option number and --tcp-flags.

For the window size, you can use the string module with the option: --hex-string pattern. So, the option will be --hex-string 02CB in your case. To get accurate results, you should restrict the search offset using --from and --to. Look at iptables manual for more info.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.