Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

With iptables I want to accept three-way handshake of a TCP connection and then drop the connection. Is it possible, if so how?

share|improve this question
3  
Out of curiosity, why would you want that? –  Tibor Jul 11 '12 at 13:24

1 Answer 1

up vote 1 down vote accepted

Check this - search for --tcp-flags

You should accepts packets with SYN, SYN+ACK and ACK flags set, and drop everything else.

share|improve this answer
    
This won't work since on a "running" tcp-connection many packets contain ACKs. Even on long downloads this is set even it's not necessary. Have just been testing this. –  Michuelnik Jul 11 '12 at 13:42
    
yes, 'ACK' but not 'SYN' AND 'ACK'. Step two of handshake (syn/ack) has both flags set to 1, not just ACK. –  mulaz Jul 11 '12 at 13:46
    
That's not, what you said. :-p You say: "SYN, SYN+ACK and ACK" - that last ACK is "just ACK" - isnt it? (AND: The third packet of the handshake is "just a normal" packet containing just an ACK) –  Michuelnik Jul 11 '12 at 13:47
    
damn not enough coffee i guess.. let me rethink... –  mulaz Jul 11 '12 at 14:02
    
Ok another idea, after the rules above, you can limit the number of packets ( -m connbytes, --connbytes (number) and --connbytes-mode packets ) to allow only three packets (both directions).... or you could just limit packets to 3 with tcp :) (not sure if it works though, 1 in two out or vice-versa) –  mulaz Jul 11 '12 at 14:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.