Avocent Cyclades ACS Service Manual download pdf (Page 33)

Chapter 2: Network Configuration 25

Match extensions

Iptables may use extended packet matching modules. These are loaded in two ways: implicitly,

when -p or - -protocol is specified, or with the -m or - -match option, followed by the matching

module name; after these, various extra command line options become available, depending on the

specific module.

TCP extensions

These extensions are loaded if the protocol specified is tcp or -m tcp is specified. It provides the

following options.

-n - -numeric

Numeric output. IP addresses and port numbers are printed in numeric format. By default the

program tries to display them as host names, network names or service, when applicable.

-x - -exact

Expand numbers. Display the exact value of the packet and byte counters, instead of only the

rounded number in K's (multiples of 1000) M's (multiples of 1000K) or G's (multiples of

1000M). This option is specific to the -L command.

- -line-numbers When listing rules, add line numbers to the beginning of each rule, corresponding to that

rule's position in the chain.

Table 2.10: iptables Rules Specifications (Continued)

Parameter Description

Table 2.11: TCP Extensions

TCP extension Description

--source-port [!] [port[:port]] Source port or port range specification. This may either be a service

name or a port number. Inclusive range may also be specified, using the

format port:port. If the first port is omitted, 0 is assumed; if the last is

omitted, “65535” is assumed. If the second port is greater then the first

they is swapped. The flag - -sport is an alias for this option.

--destination-port [!] [port[:port]] Destination port or port range specification. The flag

- -dport is an alias for this option.

--tcp-flags [!] mask comp Match when the TCP flags are as specified. The first argument is the

flags which we should examine, written as a comma-separated list and

the second argument is a comma-separated list of flags which must be

set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the

command iptables

-A FORWARD -p tcp - -tcp-flags SYN,ACK,FIN,RST SYN only matches

packets with the SYN flag set and the ACK, FIN and RST flags unset.

1 2 ... 28 29 30 31 32 33 34 35 36 37 38 ... 151 152

No comments

Avocent Cyclades ACS Service Manual Page 33