Patrick Schaaf kindly pointed out that I could do this. iptables -I INPUT -s 0.0.0.0/0.0.255.255 -j DROP That will drop any IP that ends in 0.0 Thanks for every ones help. I will also look into the u32 patch thanks again. On Thursday 23 January 2003 19:04, you wrote: > > I do not want to block every IP on say 45.208.0.0/16 just the ips ending > > in 0.0 as the last two octets. > > > > I can write a tcpdump filter to find the traffic Im just not sure if we > > have a way to craft a netfilter rule to do so. Or maybe the "recent" > > patch could be of use. Although the dDoS included 65000 source IP > > addresses. all ending in 0.0 for the ip address. > > > > the tcdump filter looks like this. > > > > tcpdump -nn -i eth0 'ip[18:2] == 00' > > The u32 match I recently posted can do this. -- Daniel Fairchild - Chief Security Engineer | danielf@supportteam.net The distance between nothing and infinity is always the same no matter how close you get to nothing.
