Re: icmp messages to spoofed address accepted by -m conntrack --ctstate ESTABLISHED,RELATED (nfcan: addressed to exclusive sender for this address)

[Jim Laurino <JimLaur@xxxxxxx>]

On 2004.03.18 17:35, Jim Laurino  - nfcan.x.jimlaur@dfgh. 
net wrote:
> I added a rule with this matching pattern to
> the iptables firewall on my machine.
>
> -m conntrack --ctstate ESTABLISHED,RELATED
>
> It is matching icmp packets about an
> unreachable destination that are sent here
> because someone is spoofing my IP address.
>
> I do not see in /proc/net/ip_conntrack
> any entry that I think should match these packets.
>
> I have come here to try to find out if this
> match is the expected behavior of this rule,
> or if this match is a misuse of the conntrack
> module by me, or if this is a bug in connection tracking.
>
> Regards,
>
> Jim Laurino