There is TCPMSS target to edit MSS value of connections (including forwarded).

How to edit window size (for example, cap to some maximum value) by iptables rule?

Expecting something like

iptables -t mangle -A OUTPUT -p tcp --dport 1234 -j TCPWINDOW --tcpwindow-set 'min(val,100000)'
  • Have to admit, pretty curious as to why you would want to do this? – Kyle Brandt Aug 1 '13 at 19:59
  • I'm playing with traffic shaping currently and looking for various ways to limit inbound TCP traffic. I think capping the receive window + adding some delay (tc qdisc ... netem delay ...) can more or less cleanly set the speed of receiving without crude things like intentionally dropping valid packets. – Vi. Aug 1 '13 at 20:24
  • 1
    Dropping packets is a valid way to inform about congestion. Other way is using ECN (rfc3168), if both ends support it. – Teftin Aug 1 '13 at 23:03
up vote 3 down vote accepted

To change TCP window from iptables you need to:

iptables -t mangle -I OUTPUT -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j TCPWIN --tcpwin-set 1000

Yes, you can use the option --set-mss to achieve this.

Example:

iptables -I FORWARD -o ppp0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1492

Documentation: http://www.linuxtopia.org/Linux_Firewall_iptables/x4700.html

  • 1
    MSS and TCP Window are similar but still different things. – Bratchley Mar 31 '15 at 14:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.