Messages in this thread | | | From | Amin Azez <> | Subject | Re: [PATCH] chaostables | Date | Fri, 09 Mar 2007 09:35:37 +0000 |
| |
* Jan Engelhardt wrote, On 08/03/07 20:26: > xt_portscan needs to keep track of what packets the machine has already > seen. So on the first SYN, the connection is marked with "1". (Then we > send our SYN-ACK... and the connection turns ESTABLISHED.) The next > packet that is received will be an ACK or an RST. But it must come > _exactly after_ the SYN, so just using --tcp-flags ACK will not work. A > state which can be remembered is required. For that, an automaton is > used, whose state is saved in the connection mark.
There would me more point in having this as a new match if it didn't trample on the connection mark, but used it's own slot or flag-bit.
Sam
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |