On Thursday 2008-06-19 12:31, Vladislav Kurz wrote: >> >> > I noticed that iptables offers new match: -m conntrack --ctstate >> > which has also NEW, RELATED, ESTABLISHED and INVALID states. Are they >> > somehow different from those matched by -m state --state ? >> >> The conntrack match offers more internal flags (like SNAT, DNAT) above >> the state match. > >Ok, thats documented,what I wanted to know is if the four states NEW, RELATED, >ESTABLISHED and INVALID are equal in -m conntrack and -m state. They are the same, but conntrack has more matching options. >> > iptables -t filter -A INPUT -m state --state NEW -p tcp ! --syn -j LOG >> > >> > and it catches quite a lot of packets, but still it seems that conntrack >> > knows about TCP connections being opened (SYN) and closed (FIN). Is there >> > any reason for NEW packets without SYN to be allowed through? >> >> Yes, it's a (well known) feature of netfilter. This way we can catch up >> connections already established. If you do not want to support it, use >> the last rule you wrote. > >I thought it might be useful to block some weird portscans (e.g. nmap xmas >scan). Xmas scans can be matched much more easily - using INVALID, see http://jengelh.medozas.de/projects/chaostables/ -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
