hi * he@xxxxxxxx wrote: > in the LARTC-HowTo is an example given for matching packets with the > ACK-bit set. > > Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the > HowTo) mean that you are just matching Packets with an ACK set but > without any data? If I am right, this would mean that just > Forward-Acknowledgements are matched, isn't it? >tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \ > match ip protocol 6 0xff \ matches tcp > match u8 0x05 0x0f at 0 \ matches packets with IHL == 5 -> no ip options > match u16 0x0000 0xffc0 at 2 \ matches packets smaller than 64 byte. now we have 14 byte ethernet + 20 byte ip + ~20 bytes tcp header makes 56 byte headers, so there is not much free space for payload > match u8 0x10 0xff at 33 \ matches the ACK bit > flowid 1:10 now, cause almost all packets have the ACK bit set this rule matches all small packets with no ip options. it could be done better with nexthdr to match packets with ip options set too. > What about matching ACKs with iptables, is it possible to mark Packets > with ACK set but without data? Doesnt make much sense, because every packet except a few during handshake at begin and end have the ACK bit set. Actually, packets with only ACK set and no payload are rare. -- Thomas Graf
