I need a rule to match packets with no options set and/or specific window receiving size set:

IP (tos 0x0, ttl 66, id 9000, offset 0, flags [none], proto TCP (6), length 40) y.y.y.y.11111 > x.x.x.x.http: Flags [S], cksum 0xe425 (correct), seq 1729214256, win 715, length 0

So this packet has win 715, flags [none] -> how could I match such packets?

  • Are you considering any other options, for e.g: Snort? – quanta Nov 25 '11 at 6:24

Thank you for answers, but I think I found the best solution (best in speed):

iptables -I INPUT -m u32 --u32 "6&0xFF=0x6 && 0>>22&0x3C@12&0xFFFF=0x02CB" -j LOG

The line above ensures that is a TCP packet, then find the IP length and adopts (there is an additional two byte extraction) it to the bytes ones need to compare (in the example 715). In one word everyone could extract/find/compare every bit/byte in the packets with the great module -> u32. For more info: iptables-u32.v0.1

  • Yeah, good job, works perfectly – Shocker Aug 29 '14 at 21:25

Iptables has options to deal with TCP flags and TCP options, namely --tcp-option number and --tcp-flags.

For the window size, you can use the string module with the option: --hex-string pattern. So, the option will be --hex-string 02CB in your case. To get accurate results, you should restrict the search offset using --from and --to. Look at iptables manual for more info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.