Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Everyone, As I understand it, OSF has been merged with the Kernel since 2.6.before-my-kernel-version. Yet when I do something like this:

iptables -I INPUT -j ACCEPT -p tcp -m osf --genre Linux --log 0 --ttl 2

and I get an error like:

iptables: No chain/target/match by that name
iptables -L

Shows no rules because I did an iptables -F at one point.

ALSO, the following command:

cat /proc/net/ip_tables_matches 

Does not show "osf" on the list.

A google doesn't seem to help. I've also installed iptables-devel in hopes I'd be able to load the osf module. Sadly I haven't been able to get that to work.

Centos 6.4 minimal

Any guidance?

Edit: Adding requested codes:

-bash-4.1# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

-bash-4.1# iptables -I INPUT -j ACCEPT -p tcp -m osf --genre Linux --log 0 --ttl 2
iptables: No chain/target/match by that name.
share|improve this question
I suspect this question is not quite what it seems. Could you cut and paste the iptables command, and the response, rather than retyping it? Editing that into your question will probably be easiest. –  MadHatter Nov 1 '13 at 21:44
OK, that kills hypothesis one. man iptables-extensions suggests that you have to preload the fingerprints from a database; that ring any bells? –  MadHatter Nov 1 '13 at 22:31
add comment

1 Answer

up vote 2 down vote accepted

The OS fingerprinting module doesn't come preloaded with fingerprint data; to keep it up to date, you have to get the fingerprint database from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os, and load it in with the nfnl_osf tool, which on Fedora at least is in the iptables-utils package. Until these fingerprints are loaded, it has no genres to match, hence the error message.

Unfortunately, I can't find any place to get the nfnl_osf tool for C6; if you do this on F19, you get the following:


[root@risby named]# iptables -A INPUT -j ACCEPT -p tcp -m osf --genre Linux
iptables: No chain/target/match by that name.

Having got the latest version of the fingerprint file from that link:

[root@risby named]# nfnl_osf -f /tmp/pf.os 
2013-11-01 22:37:39.256107 15507 Loading '45046:64:0:44:M*:     AIX:4.3::AIX 4.3'.
        [ many lines of output deleted ]
[root@risby named]# iptables -A INPUT -j ACCEPT -p tcp -m osf --genre linux --log 0 --ttl 2
[root@risby named]# iptables -L INPUT -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    6   304 ACCEPT     tcp  --  *      *              OS fingerprint match linux
[root@risby named]# 

So we might reasonably conclude that it's coming, but C6 doesn't have the toolchain yet. It does have osf capability, since I get this on C6:

[root@bill yum.repos.d]# iptables -A FOO -j ACCEPT -p tcp -m osf 
iptables v1.4.7: OS fingerprint match: You must specify `--genre'
Try `iptables -h' or 'iptables --help' for more information.
[root@bill yum.repos.d]# iptables -A FOO -j ACCEPT -p tcp -m osf --genre Linux
iptables: No chain/target/match by that name.

But, as my Fedora testing above shows, it's useless without the fingerprint loading tool. At the moment, it seems you can either wait for the functionality to make its way through the food chain, possibly in C7, or try finding the source for the tool (possibly by stripping it out of the F19 iptables-utils package) and compiling it yourself. How badly you need it will drive what you choose to do.

share|improve this answer
This is a great comment. Working through it, but the iptables utilities you mention . . . yum install iptables-utils doesn't seem to work. yum search iptables doesn't seem to show any helpful packages. Any suggestions? –  user1197457 Nov 1 '13 at 23:14
Sorry, I wrote the above late at night, and this morning realised my thunderously stupid error, to wit, I did all the above on a dispoable box, and all my disposable boxes are Fedora. I've updated the answer accordingly. –  MadHatter Nov 2 '13 at 8:29
Seems reasonable. I'll just use Fedora (-: –  user1197457 Nov 4 '13 at 17:11
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.