Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

When looking in the /var/log/messages file I found this line:

May 23 10:56:02 localhost kernel: IP4T Invalid TCP flags IN=eth0 OUT= MAC=70:5a:b6:ec:95:6b:00:23:48:ad:b0:a4:08:00 SRC=A.B.C.D DST=192.168.1.27 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=27653 DF PROTO=TCP SPT=443 DPT=58520 WINDOW=0 RES=0x00 ACK RST URGP=0

I have these iptables rules in the filter table:

Chain INPUT (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination
1           0        0 TCPFlagsCheck  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0
2           0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.1.27        tcp spt:80 state ESTABLISHED
3           0        0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            192.168.1.27        tcp spt:443 state ESTABLISHED
4           0        0 ACCEPT     udp  --  eth0   *       192.168.1.1          192.168.1.27        udp spt:53
5           0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination
1           0        0 TCPFlagsCheck  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0
2           0        0 ACCEPT     tcp  --  *      eth0    192.168.1.27         0.0.0.0/0           tcp dpt:80 state NEW,ESTABLISHED
3           0        0 ACCEPT     tcp  --  *      eth0    192.168.1.27         0.0.0.0/0           tcp dpt:443 state NEW,ESTABLISHED
4           0        0 ACCEPT     udp  --  *      eth0    192.168.1.27         192.168.1.1         udp dpt:53
5           0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4

Chain TCPFlagsCheck (2 references)
num      pkts      bytes target     prot opt in     out     source               destination
1           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x10 /* R ACK */
2           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x18 /* R ACK PSH */
3           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x12 /* R SYN ACK */
4           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x02 /* R SYN */
5           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x04 /* R RST */
6           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x11 /* R ACK FIN */
7           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x19 /* R ACK PSH FIN */
8           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x14 /* R ACK RST */
9           0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x01 /* R FIN */
10          0        0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `IP4T Invalid TCP flags '
11          0        0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0

I had doubts so I wrote the same command to check if the rule is correct:

$ iptables -A TCPFlagsCheck -j RETURN -p tcp --tcp-flags ALL ACK,RST \
    -m comment --comment "R ACK RST"

and this creates:

12          0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x14 /* R ACK RST */

Why was this packet dropped?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.