Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error.

# iptables -I INPUT -j DROP -d xxx.xxx.xxx.xxx -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.'
iptables: No chain/target/match by that name.

When listing the rules:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
[...]

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
[...]

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[...]

Could anyone shed some light on the situation? I am running on Ubuntu server 12.04 32-bit.

share|improve this question
1  
Is the string module compiled in? You should something like xt_string.ko when you run find /lib/modules/$(uname -r) -name '*string*'? –  Zoredache Aug 28 '12 at 17:47
    
This works as posted on the Ubuntu (9.10 and 12.04.1) I have to hand. –  Iain Aug 28 '12 at 18:23
    
I'm not seeing xt_string when using find or modprobe as suggested by Dom. I'm guessing that it doesn't come by default? Where may I find this? –  tatersalad58 Aug 28 '12 at 18:51
    
OMG, just modprobe ip_conntrack and it should load it all –  Andrew Smith Aug 28 '12 at 23:33
    
Are you sure you aren't using OpenVZ? –  Michael Hampton Jul 10 at 12:32

1 Answer 1

I think the -j DROP should at the end of line. But check the module too : modprobe xt_string

share|improve this answer
    
It works as posted on the systems I have to hand –  Iain Aug 28 '12 at 18:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.