IPtables and String Match

"Walter H." <walter.h@xxxxxxxxxxxxxxxxx> · Thu, 24 Aug 2017 14:58:24 +0200

Hello,

-N VERIFY-HTTP
-A VERIFY-HTTP -m string --to 61 --algo bm --string "GET /w00tw00t.at." \
                        -j LOG --log-prefix "IP[HTTP-SCAN]: " --log-level 7
-A VERIFY-HTTP -j ACCEPT

and

-A INPUT -i eth1 -m tcp -p tcp --dport 80 -m state --state NEW -j VERIFY-HTTP

I would expect that HTTP requests like

wget http://thishost/w00tw00t.at.SANS

would be logged, but it isn't

why?

Thanks,
Walter

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html