Is my assumtion correct that state RELATED,ESTABLISHED checks all flags
for match and thus this state can (and should be for performance reasons)
be the first in each table ?
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
15172 2029K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 BADTCP tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
....
Chain BADTCP (6 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 3 LOG level alert prefix `ipt - Blocked Bad TCP flag: '
0 0 DROP all -- any any anywhere anywhere
Thank you
Michael
