Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:"

iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -j DROP


1) I'm making a new user generated chain with the -N option
2) I'm logging NEW packets that aren't syn, and I'm adding a limit trying to prevent my log files from getting flooded
3) I'm dropping the NEW packets that aren't SYN
4) I'm using -f because I'm left with the fragmented packets, and I want to drop those packets.

A recommendation to improve something similar was found here , which is to add it in -t raw -A PREROUTING

A) I don't quite understand what's being said, how do I add it "in" ?
And it seems like a risky thing to do, because it sets a mark on packets that they should not be handled by the connection tracking system.

B) And why is that necessary ? I'm dropping those packets so what exactly is the benefit of marking those packets ?

All that being said, is there anything that can be done when I do get the initial SYN fragment, but I don't get the last one ?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.