/* Since it passed flags test in tcp match, we know it is is
not a fragment, and has data >= tcp header length. SYN
packets should not contain data: if they did, then we risk
running over MTU, sending Frag Needed and breaking things
badly. --RR */
if (tcplen != tcph->doff*4) {
if (net_ratelimit())
printk(KERN_ERR
"ipt_tcpmss_target: bad length (%d
bytes)\n",
(*pskb)->len);
return NF_DROP;
}
Feb 20 09:47:02 klogd: ipt_tcpmss_target: bad length (60 bytes)
Feb 20 09:47:07 klogd: ipt_tcpmss_target: bad length (60 bytes)
Feb 20 09:47:11 klogd: ipt_tcpmss_target: bad length (60 bytes)
(router date is wrong)
That is a little excerpt from ipt_TCMSS.c. The problem is that somebody
DoS'd me with syn Packets that contained data len(header) <!=
len(packet). I have a little ServGate SG100 router that handles my T1
connection. The router physically seized for the 5 minutes or so while
he packeted because of the amount of logging I'm guessing. How can I
block this with just an iptables ruleset? I'm trying not to limit the
incoming number of syn packets and I cant recompile netfilter since it
is running on a flavored kernel custom for the router. How am I going to
prevent this in the future?
