Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.

One line of my log looks something like this:

Nov 29 17:00:00 IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=53 ID=37898 DF PROTO=TCP SPT=57755 DPT=8888 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204057D010303010101080A3E521D4D0000000004020000)

I would like to understand how to interpret the OPT string (bold).

  • Is there some documentation available on what it actually means?
  • How could I make it human-readable?
share|improve this question
    
"How could I make it human-readable" is too open-ended for this site. Now that you have the documentation, take a shot at making it human readable yourself and ask another question if you get stuck. We have no idea what tools you have available/are comfortable with, what format you consider acceptable, or where you want the transform to take place. You're both asking us to BOTH do your work for you and mind-read what work you want done. –  Mark Dec 12 '12 at 14:09

3 Answers 3

up vote 3 down vote accepted

0204057D010303010101080A3E521D4D0000000004020000
From a sans.org study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document: ftp://ftp.ietf.org/iana/tcp-parameters/tcp-parameters.xml
Others: http://tools.ietf.org/html/draft-ietf-tcpm-tcp-security-03
http://www.ietf.org/mail-archive/web/tcpm/current/msg03199.html

for humor! : http://tools.ietf.org/html/rfc5841

share|improve this answer

The RFC 791 defines the IPv4 protocol. In section 3.1, starting at page 15, there is an explanation about the OPTIONS field.

Source : RFC 791

share|improve this answer
    
Thanks, could you maybe provide some example based on my output to make it human-readable? –  alex Dec 6 '12 at 15:35

This is the options part of the TCP header.

Look here for detailed information.

share|improve this answer
    
Hm, I already know about the OPT header itself and also what it does. Could you elaborate on how I would parse such a sting and give an example based on my output? –  alex Dec 6 '12 at 14:59
    
BTW, Wikipedia is not an credible and/or official source. –  alex Dec 6 '12 at 15:02
    
Is this a statement of yours or has this been discussed on the stackexchange network? –  Christophe Drevet Dec 6 '12 at 15:16
1  
well, if you dont believe what you read at wikipedia, then you can check the source (also referred to in the wiki section) here: tools.ietf.org/html/rfc793 And no, i dont want to do your work, that not the point of this site. if you know how it works, take your time and parse the output yourself. –  randoms Dec 6 '12 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.