I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.

One line of my log looks something like this:

Nov 29 17:00:00 IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=53 ID=37898 DF PROTO=TCP SPT=57755 DPT=8888 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204057D010303010101080A3E521D4D0000000004020000)

I would like to understand how to interpret the OPT string (bold).

  • Is there some documentation available on what it actually means?
  • How could I make it human-readable?
  • "How could I make it human-readable" is too open-ended for this site. Now that you have the documentation, take a shot at making it human readable yourself and ask another question if you get stuck. We have no idea what tools you have available/are comfortable with, what format you consider acceptable, or where you want the transform to take place. You're both asking us to BOTH do your work for you and mind-read what work you want done.
    – Mark
    Dec 12, 2012 at 14:09

3 Answers 3


From a sans.org study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document: ftp://ftp.ietf.org/iana/tcp-parameters/tcp-parameters.xml
Others: https://datatracker.ietf.org/doc/html/draft-ietf-tcpm-tcp-security-03

for humor! : https://www.rfc-editor.org/rfc/rfc5841


The RFC 791 defines the IPv4 protocol. In section 3.1, starting at page 15, there is an explanation about the OPTIONS field.

Source : RFC 791

  • Thanks, could you maybe provide some example based on my output to make it human-readable?
    – alex
    Dec 6, 2012 at 15:35

This is the options part of the TCP header.

Look here for detailed information.

  • Hm, I already know about the OPT header itself and also what it does. Could you elaborate on how I would parse such a sting and give an example based on my output?
    – alex
    Dec 6, 2012 at 14:59
  • BTW, Wikipedia is not an credible and/or official source.
    – alex
    Dec 6, 2012 at 15:02
  • Is this a statement of yours or has this been discussed on the stackexchange network? Dec 6, 2012 at 15:16
  • 1
    well, if you dont believe what you read at wikipedia, then you can check the source (also referred to in the wiki section) here: tools.ietf.org/html/rfc793 And no, i dont want to do your work, that not the point of this site. if you know how it works, take your time and parse the output yourself.
    – randoms
    Dec 6, 2012 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.