Removing packets with a matching line using iptables will discard all subsequent packets without a match
I am trying to write an application-level worm filtering utility.
I have the following rule to install a tcp package with a specific substring.
iptables -A INPUT -p tcp -m string -string "test" -j DROP --algo kmp
however, as soon as a packet with a matching line is found, all subsequent packets, even those with mismatched lines, will be discarded until I reset the rule from iptable.
I would like to know why this is happening and what is his solution.
thank
a source to share
tcp is a connected oriented reliable protocol that maintains consistency in the data sent. it keeps trying to change a particular payload until it reaches it, so you can't send another subsequent payload until the old one is reached, so you feel like all subsequent packets are dropped.
If you set a similar rule for udp, this does not happen, you will be able to get all subsequent packets that do not match the string. this is because udp is a contactless, unreliable protocol.
a source to share
A bit late, but people with similar problems. One way to get around this is to do this rule in the RAW chain. ALL packets will get here before any socket is put into the packet, so it's best to do filtering here.
iptables -A PREROUTING -t raw -p tcp -m string --string "test" -j DROP --algo kmp
a source to share