[lkml]   [2000]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] ipchains log will show all flags
    On Wed, 6 Dec 2000, Rusty Russell wrote:

    >Date: Wed, 06 Dec 2000 00:55:09 +1100
    >From: Rusty Russell <>
    >To: Christian W. Zuckschwerdt <>
    >Subject: Re: [PATCH] ipchains log will show all flags
    >In message <0012051408110.1526-100000@localhost> you write:
    >> Hi Linus,
    >> This tiny patch extends ipchains logging. This way one can distinguish
    >> (plain) connection attempts and (Xmas, Fin,...) scans. E.g.
    >> kernel: Packet log: input - lo PROTO=6
    >> L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
    >> vs.
    >> L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=-s--a-
    >> and
    >> L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=fs-p-u
    >> Please comment on the format (B=...) and implementation details (speed).
    >> The patch is against 2.2.17's /net/ipv4/ip_fw.c
    >Looks OK, but CC'ing the maintainer is simple politeness.
    >> + if (ip->protocol == IPPROTO_TCP)
    >You probably want to insert `&& !(ip->frag_off & htons(IP_OFFSET))'
    >> + tcp-syn ? 's' : '-', tcp->rst ? 'r' : '-',
    >You mean `tcp->syn' not `tcp-syn'.
    >I like the fact that it doesn't disturb the format, simply appends,
    >and it has been a not-uncommon request.
    >But application is up to Alan Cox, who ruleth the 2.2 series.

    Personally, I'd like to see the rule number stay on the end,and
    have the new display just before it. The rule number in the
    middle looks messy.

    Mike A. Harris - Linux advocate - Open source advocate
    This message is copyright 2000, all rights reserved.
    Views expressed are my own, not necessarily shared by my employer.

    Microsoft Windows(tm). A thirty-two bit extension and graphical shell
    to a sixteen bit patch to an eight bit operating system originally
    coded for a four bit microprocessor which was written by a two-bit
    company that can't stand one bit of competition.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 12:51    [W:0.023 / U:15.608 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site