Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error.

# iptables -I INPUT -j DROP -d -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /'
iptables: No chain/target/match by that name.

When listing the rules:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Could anyone shed some light on the situation? I am running on Ubuntu server 12.04 32-bit.

share|improve this question
Is the string module compiled in? You should something like xt_string.ko when you run find /lib/modules/$(uname -r) -name '*string*'? – Zoredache Aug 28 '12 at 17:47
This works as posted on the Ubuntu (9.10 and 12.04.1) I have to hand. – Iain Aug 28 '12 at 18:23
I'm not seeing xt_string when using find or modprobe as suggested by Dom. I'm guessing that it doesn't come by default? Where may I find this? – tatersalad58 Aug 28 '12 at 18:51
OMG, just modprobe ip_conntrack and it should load it all – Andrew Smith Aug 28 '12 at 23:33
Are you sure you aren't using OpenVZ? – Michael Hampton Jul 10 '14 at 12:32

1 Answer 1

I think the -j DROP should at the end of line. But check the module too : modprobe xt_string

share|improve this answer
It works as posted on the systems I have to hand – Iain Aug 28 '12 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.