What is the meaning of UNCLEAN state in iptables?


iptables -A INPUT -m conntrack --ctstate UNCLEAN -j DROP

This actually gives me an error, but there should exist an unclean state.

Moreover, what is the difference and connection with INVALID state?



  • The UNCLEAN match takes no options and requires no more than explicitly loading it when you want to use it. Note that this option is regarded as experimental and may not work at all times, nor will it take care of all unclean packages or problems. The unclean match tries to match packets that seem malformed or unusual, such as packets with bad headers or checksums and so on. This could be used to DROP connections and to check for bad streams, for example; however you should be aware that it could possibly break legal connections.

  • As a side note : It was removed a while ago (sorry, don't recall exactly when, but I believe it was with the start of the 2.6.x tree). They cited the fact that it was not being used properly and the implementation wasn't what they wanted anyway. Something to that effect. It should be in one of the 2.6.x changelogs I think.

INVALID : Referred from

  • The INVALID state means that the packet can't be identified or that it does not have any state. This may be due to several reasons, such as the system running out of memory or ICMP error messages that do not respond to any known connections. Generally, it is a good idea to DROP everything in this state.
  • Rule with INVALID state will drop all packets with invalid headers or checksums, invalid TCP flags, invalid ICMP messages (such as a port unreachable when we did not send anything to the host), and out of sequence packets which can be caused by sequence prediction or other similar attacks. The DROP target will drop a packet without any response, contrary to REJECT which politely refuses the packet. We use DROP because there is no proper REJECT response to packets that are INVALID, and we do not want to acknowledge that we received these packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.