Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.

One line of my log looks something like this:

Nov 29 17:00:00 IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=53 ID=37898 DF PROTO=TCP SPT=57755 DPT=8888 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204057D010303010101080A3E521D4D0000000004020000)

I would like to understand how to interpret the OPT string (bold).

  • Is there some documentation available on what it actually means?
  • How could I make it human-readable?
share|improve this question
"How could I make it human-readable" is too open-ended for this site. Now that you have the documentation, take a shot at making it human readable yourself and ask another question if you get stuck. We have no idea what tools you have available/are comfortable with, what format you consider acceptable, or where you want the transform to take place. You're both asking us to BOTH do your work for you and mind-read what work you want done. – Mark Dec 12 '12 at 14:09

3 Answers 3

up vote 3 down vote accepted

From a study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document:

for humor! :

share|improve this answer

The RFC 791 defines the IPv4 protocol. In section 3.1, starting at page 15, there is an explanation about the OPTIONS field.

Source : RFC 791

share|improve this answer
Thanks, could you maybe provide some example based on my output to make it human-readable? – alex Dec 6 '12 at 15:35

This is the options part of the TCP header.

Look here for detailed information.

share|improve this answer
Hm, I already know about the OPT header itself and also what it does. Could you elaborate on how I would parse such a sting and give an example based on my output? – alex Dec 6 '12 at 14:59
BTW, Wikipedia is not an credible and/or official source. – alex Dec 6 '12 at 15:02
Is this a statement of yours or has this been discussed on the stackexchange network? – Christophe Drevet Dec 6 '12 at 15:16
well, if you dont believe what you read at wikipedia, then you can check the source (also referred to in the wiki section) here: And no, i dont want to do your work, that not the point of this site. if you know how it works, take your time and parse the output yourself. – randoms Dec 6 '12 at 21:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.