4

I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.

One line of my log looks something like this:

Nov 29 17:00:00 IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=53 ID=37898 DF PROTO=TCP SPT=57755 DPT=8888 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204057D010303010101080A3E521D4D0000000004020000)

I would like to understand how to interpret the OPT string (bold).

  • Is there some documentation available on what it actually means?
  • How could I make it human-readable?
Improve this question
1
  • "How could I make it human-readable" is too open-ended for this site. Now that you have the documentation, take a shot at making it human readable yourself and ask another question if you get stuck. We have no idea what tools you have available/are comfortable with, what format you consider acceptable, or where you want the transform to take place. You're both asking us to BOTH do your work for you and mind-read what work you want done.
    – Mark
    Dec 12, 2012 at 14:09

3 Answers 3

Reset to default
3

0204057D010303010101080A3E521D4D0000000004020000
From a sans.org study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document: ftp://ftp.ietf.org/iana/tcp-parameters/tcp-parameters.xml
Others: https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-tcp-security-03
http://www.ietf.org/mail-archive/web/tcpm/current/msg03199.html

for humor! : https://www.rfc-editor.org/rfc/rfc5841

Improve this answer
3
+25

The RFC 791 defines the IPv4 protocol. In section 3.1, starting at page 15, there is an explanation about the OPTIONS field.

Source : RFC 791

Improve this answer
1
  • Thanks, could you maybe provide some example based on my output to make it human-readable?
    – alex
    Dec 6, 2012 at 15:35
0

This is the options part of the TCP header.

Look here for detailed information.

Improve this answer
4
  • Hm, I already know about the OPT header itself and also what it does. Could you elaborate on how I would parse such a sting and give an example based on my output?
    – alex
    Dec 6, 2012 at 14:59
  • BTW, Wikipedia is not an credible and/or official source.
    – alex
    Dec 6, 2012 at 15:02
  • Is this a statement of yours or has this been discussed on the stackexchange network?
    – Christophe Drevet
    Dec 6, 2012 at 15:16
  • 1
    well, if you dont believe what you read at wikipedia, then you can check the source (also referred to in the wiki section) here: tools.ietf.org/html/rfc793 And no, i dont want to do your work, that not the point of this site. if you know how it works, take your time and parse the output yourself.
    – randoms
    Dec 6, 2012 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .