firewall SYN,ACK,FIN,RST,URG,PSH

[Jirka Kosina]

On Tue, 19 Oct 2004, AntiTrust wrote:

> a nerozumiem tomuto:
> --tcp-flags
>      Followed by an optional `!', then two strings of flags, allows you 
> to filter on specific TCP flags. The first string of flags is the mask: 
> a list of flags you want to examine. The second string of flags tells 
> which one(s) should be set. For example,
>      This indicates that all flags should be examined (`ALL' is 
> synonymous with `SYN,ACK,FIN,RST,URG,PSH'), but only SYN and ACK should 
> be set. There is also an argument `NONE' meaning no flags.
> Co sa tu snazi autor povedat?

Tim se autor snazi rict, ze pokud napisete

iptables -A INPUT --tcp-flags SYN,ACK SYN,\!ACK -j DROP

tak zahodite vsechny packety, ktere maji nastaveny SYN ale nemaji 
nastaveny ACK, atd.

Co ze tyce vyznamu ostatnich flagu - viz RFC 793.

-- 
JiKos.