iptables can use extended packet matching modules. These are loaded in
two ways: implicitly, when -p or --protocol is specified, or with the
-m or --match options, followed by the matching module name; after
these, various extra command line options become available, depending
on the specific module. You can specify multiple extended match mod-
ules in one line, and you can use the -h or --help options after the
module has been specified to receive help specific to that module.
The following are included in the base package, and most of these can
be preceded by a ! to invert the sense of the match.
addrtype
This module matches packets based on their address type. Address types
are used within the kernel networking stack and categorize addresses
into various groups. The exact definition of that group depends on the
specific layer three protocol.
The following address types are possible:
UNSPEC an unspecified address (i.e. 0.0.0.0) UNICAST an unicast address
LOCAL a local address BROADCAST a broadcast address ANYCAST an
anycast packet MULTICAST a multicast address BLACKHOLE a black-
hole address UNREACHABLE an unreachable address PROHIBIT a pro-
hibited address THROW FIXME NAT FIXME XRESOLVE FIXME
--src-type type
Matches if the source address is of given type
--dst-type type
Matches if the destination address is of given type
ah
This module matches the SPIs in AH header of IPSec packets.
--ahspi [!] spi[:spi]
childlevel
This is an experimental module. It matches on whether the packet is
part of a master connection or one of its children (or grandchildren,
etc). For instance, most packets are level 0. FTP data transfer is
level 1.
--childlevel [!] level
condition
This matches if a specific /proc filename is ’0’ or ’1’.
--condition [!] filename
Match on boolean value stored in /proc/net/ipt_condition/file-
name file
connmark
This module matches the netfilter mark field associated with a connec-
tion (which can be set using the CONNMARK target below).
--mark value[/mask]
Matches packets in connections with the given mark value (if a
mask is specified, this is logically ANDed with the mark before
the comparison).
connrate
This module matches the current transfer rate in a connection.
--connrate [!] [from]:[to]
Match against the current connection transfer rate being within
’from’ and ’to’ bytes per second. When the "!" argument is used
before the range, the sense of the match is inverted.
conntrack
This module, when combined with connection tracking, allows access to
more connection tracking information than the "state" match. (this
module is present only if iptables was compiled under a kernel support-
ing this feature)
--ctstate state
Where state is a comma separated list of the connection states
to match. Possible states are INVALID meaning that the packet
is associated with no known connection, ESTABLISHED meaning that
the packet is associated with a connection which has seen pack-
ets in both directions, NEW meaning that the packet has started
a new connection, or otherwise associated with a connection
which has not seen packets in both directions, and RELATED mean-
ing that the packet is starting a new connection, but is associ-
ated with an existing connection, such as an FTP data transfer,
or an ICMP error. SNAT A virtual state, matching if the origi-
nal source address differs from the reply destination. DNAT A
virtual state, matching if the original destination differs from
the reply source.
--ctproto proto
Protocol to match (by number or name)
--ctorigsrc [!] address[/mask]
Match against original source address
--ctorigdst [!] address[/mask]
Match against original destination address
--ctreplsrc [!] address[/mask]
Match against reply source address
--ctrepldst [!] address[/mask]
Match against reply destination address
--ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED][,...]
Match against internal conntrack states
--ctexpire time[:time]
Match remaining lifetime in seconds against given value or range
of values (inclusive)
dscp
This module matches the 6 bit DSCP field within the TOS field in the IP
header. DSCP has superseded TOS within the IETF.
--dscp value
Match against a numeric (decimal or hex) value [0-32].
--dscp-class DiffServ Class
Match the DiffServ class. This value may be any of the BE, EF,
AFxx or CSx classes. It will then be converted into it’s
according numeric value.
dstlimit
This module allows you to limit the packet per second (pps) rate on a
per destination IP or per destination port base. As opposed to the
‘limit’ match, every destination ip / destination port has it’s own
limit.
--dstlimit avg
Maximum average match rate (packets per second unless followed
by /sec /minute /hour /day postfixes).
--dstlimit-mode mode
The limiting hashmode. Is the specified limit per dstip, dstip-
dstport tuple, srcip-dstip tuple, or per srcipdstip-dstport
tuple.
--dstlimit-name name
Name for /proc/net/ipt_dstlimit/* file entry
[--dstlimit-burst burst]
Number of packets to match in a burst. Default: 5
[--dstlimit-htable-size size]
Number of buckets in the hashtable
[--dstlimit-htable-max max]
Maximum number of entries in the hashtable
[--dstlimit-htable-gcinterval interval]
Interval between garbage collection runs of the hashtable (in
miliseconds). Default is 1000 (1 second).
[--dstlimit-htable-expire time
After which time are idle entries expired from hashtable (in
miliseconds)? Default is 10000 (10 seconds).
ecn
This allows you to match the ECN bits of the IPv4 and TCP header. ECN
is the Explicit Congestion Notification mechanism as specified in
RFC3168
--ecn-tcp-cwr
This matches if the TCP ECN CWR (Congestion Window Received) bit
is set.
--ecn-tcp-ece
This matches if the TCP ECN ECE (ECN Echo) bit is set.
--ecn-ip-ect num
This matches a particular IPv4 ECT (ECN-Capable Transport). You
have to specify a number between ‘0’ and ‘3’.
esp
This module matches the SPIs in ESP header of IPSec packets.
--espspi [!] spi[:spi]
fuzzy
This module matches a rate limit based on a fuzzy logic controller
[FLC]
--lower-limit number"
Specifies the lower limit (in packets per second).
--upper-limit number
Specifies the upper limit (in packets per second).
helper
This module matches packets related to a specific conntrack-helper.
--helper string
Matches packets related to the specified conntrack-helper.
string can be "ftp" for packets related to a ftp-session on
default port. For other ports append -portnr to the value, ie.
"ftp-2121".
Same rules apply for other conntrack-helpers.
icmp
This extension is loaded if ‘--protocol icmp’ is specified. It pro-
vides the following option:
--icmp-type [!] typename
This allows specification of the ICMP type, which can be a
numeric ICMP type, or one of the ICMP type names shown by the
command
iptables -p icmp -h
iprange
This matches on a given arbitrary range of IPv4 addresses
[!]--src-range ip-ip
Match source IP in the specified range.
[!]--dst-range ip-ip
Match destination IP in the specified range.
length
This module matches the length of a packet against a specific value or
range of values.
--length length[:length]
limit
This module matches at a limited rate using a token bucket filter. A
rule using this extension will match until this limit is reached
(unless the ‘!’ flag is used). It can be used in combination with the
LOG target to give limited logging, for example.
--limit rate
Maximum average matching rate: specified as a number, with an
optional ‘/second’, ‘/minute’, ‘/hour’, or ‘/day’ suffix; the
default is 3/hour.
--limit-burst number
Maximum initial number of packets to match: this number gets
recharged by one every time the limit specified above is not
reached, up to this number; the default is 5.
mac
--mac-source [!] address
Match source MAC address. It must be of the form
XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets
coming from an Ethernet device and entering the PREROUTING, FOR-
WARD or INPUT chains.
mark
This module matches the netfilter mark field associated with a packet
(which can be set using the MARK target below).
--mark value[/mask]
Matches packets with the given unsigned mark value (if a mask is
specified, this is logically ANDed with the mask before the com-
parison).
mport
This module matches a set of source or destination ports. Up to 15
ports can be specified. It can only be used in conjunction with -p tcp
or -p udp.
--source-ports port[,port[,port...]]
Match if the source port is one of the given ports. The flag
--sports is a convenient alias for this option.
--destination-ports port[,port[,port...]]
Match if the destination port is one of the given ports. The
flag --dports is a convenient alias for this option.
--ports port[,port[,port...]]
Match if the both the source and destination ports are equal to
each other and to one of the given ports.
multiport
This module matches a set of source or destination ports. Up to 15
ports can be specified. It can only be used in conjunction with -p tcp
or -p udp.
--source-ports port[,port[,port...]]
Match if the source port is one of the given ports. The flag
--sports is a convenient alias for this option.
--destination-ports port[,port[,port...]]
Match if the destination port is one of the given ports. The
flag --dports is a convenient alias for this option.
--ports port[,port[,port...]]
Match if the both the source and destination ports are equal to
each other and to one of the given ports.
nth
This module matches every ‘n’th packet
--every value
Match every ‘value’ packet
[--counter num]
Use internal counter number ‘num’. Default is ‘0’.
[--start num]
Initialize the counter at the number ‘num’ insetad of ‘0’. Most
between ‘0’ and ‘value’-1.
[--packet num]
Match on ‘num’ packet. Most be between ‘0’ and ‘value’-1.
owner
This module attempts to match various characteristics of the packet
creator, for locally-generated packets. It is only valid in the OUTPUT
chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.
--uid-owner userid
Matches if the packet was created by a process with the given
effective user id.
--gid-owner groupid
Matches if the packet was created by a process with the given
effective group id.
--pid-owner processid
Matches if the packet was created by a process with the given
process id.
--sid-owner sessionid
Matches if the packet was created by a process in the given ses-
sion group.
--cmd-owner name
Matches if the packet was created by a process with the given
command name. (this option is present only if iptables was com-
piled under a kernel supporting this feature)
NOTE: pid, sid and command matching are broken on SMP
physdev
This module matches on the bridge port input and output devices
enslaved to a bridge device. This module is a part of the infrastruc-
ture that enables a transparent bridging IP firewall and is only useful
for kernel versions above version 2.5.44.
--physdev-in name
Name of a bridge port via which a packet is received (only for
packets entering the INPUT, FORWARD and PREROUTING chains). If
the interface name ends in a "+", then any interface which
begins with this name will match. If the packet didn’t arrive
through a bridge device, this packet won’t match this option,
unless ’!’ is used.
--physdev-out name
Name of a bridge port via which a packet is going to be sent
(for packets entering the FORWARD, OUTPUT and POSTROUTING
chains). If the interface name ends in a "+", then any inter-
face which begins with this name will match. Note that in the
nat and mangle OUTPUT chains one cannot match on the bridge out-
put port, however one can in the filter OUTPUT chain. If the
packet won’t leave by a bridge device or it is yet unknown what
the output device will be, then the packet won’t match this
option, unless
--physdev-is-in
Matches if the packet has entered through a bridge interface.
--physdev-is-out
Matches if the packet will leave through a bridge interface.
--physdev-is-bridged
Matches if the packet is being bridged and therefore is not
being routed. This is only useful in the FORWARD and POSTROUT-
ING chains.
pkttype
This module matches the link-layer packet type.
--pkt-type [unicast|broadcast|multicast]
random
This module randomly matches a certain percentage of all packets.
--average percent
Matches the given percentage. If omitted, a probability of 50%
is set.
realm
This matches the routing realm. Routing realms are used in complex
routing setups involving dynamic routing protocols like BGP.
--realm [!]value[/mask]
Matches a given realm number (and optionally mask).
set
This modules macthes IP sets which can be defined by ipset(8).
--set setname flag[,flag...]
where flags are src and/or dst and there can be no more than six
of them. Hence the command
iptables -A FORWARD -m set --set test src,dst
will match packets, for which (depending on the type of the set)
the source address or port number of the packet can be found in
the specified set. If there is a binding belonging to the mached
set element or there is a default binding for the given set,
then the rule will match the packet only if additionally
(depending on the type of the set) the destination address or
port number of the packet can be found in the set according to
the binding.
state
This module, when combined with connection tracking, allows access to
the connection tracking state for this packet.
--state state
Where state is a comma separated list of the connection states
to match. Possible states are INVALID meaning that the packet
could not be identified for some reason which includes running
out of memory and ICMP errors which don’t correspond to any
known connection, ESTABLISHED meaning that the packet is
associated with a connection which has seen packets in both
directions, NEW meaning that the packet has started a new con-
nection, or otherwise associated with a connection which has not
seen packets in both directions, and RELATED meaning that the
packet is starting a new connection, but is associated with an
existing connection, such as an FTP data transfer, or an ICMP
error.
tcp
These extensions are loaded if ‘--protocol tcp’ is specified. It pro-
vides the following options:
--source-port [!] port[:port]
Source port or port range specification. This can either be a
service name or a port number. An inclusive range can also be
specified, using the format port:port. If the first port is
omitted, "0" is assumed; if the last is omitted, "65535" is
assumed. If the second port greater then the first they will be
swapped. The flag --sport is a convenient alias for this
option.
--destination-port [!] port[:port]
Destination port or port range specification. The flag --dport
is a convenient alias for this option.
--tcp-flags [!] mask comp
Match when the TCP flags are as specified. The first argument
is the flags which we should examine, written as a comma-sepa-
rated list, and the second argument is a comma-separated list of
flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL
NONE. Hence the command
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
will only match packets with the SYN flag set, and the ACK, FIN
and RST flags unset.
[!] --syn
Only match TCP packets with the SYN bit set and the ACK and RST
bits cleared. Such packets are used to request TCP connection
initiation; for example, blocking such packets coming in an
interface will prevent incoming TCP connections, but outgoing
TCP connections will be unaffected. It is equivalent to --tcp-
flags SYN,RST,ACK SYN. If the "!" flag precedes the "--syn",
the sense of the option is inverted.
--tcp-option [!] number
Match if TCP option set.
--mss value[:value]
Match TCP SYN or SYN/ACK packets with the specified MSS value
(or range), which control the maximum packet size for that con-
nection.
tcpmss
This matches the TCP MSS (maximum segment size) field of the TCP
header. You can only use this on TCP SYN or SYN/ACK packets, since the
MSS is only negotiated during the TCP handshake at connection startup
time.
[!] --mss value[:value]"
Match a given TCP MSS value or range.
time
This matches if the packet arrival time/date is within a given range.
All options are facultative.
--timestart value
Match only if it is after ‘value’ (Inclusive, format: HH:MM ;
default 00:00).
--timestop value
Match only if it is before ‘value’ (Inclusive, format: HH:MM ;
default 23:59).
--days listofdays
Match only if today is one of the given days. (format:
Mon,Tue,Wed,Thu,Fri,Sat,Sun ; default everyday)
--datestart date
Match only if it is after ‘date’ (Inclusive, format:
YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to
1970)
--datestop date
Match only if it is before ‘date’ (Inclusive, format:
YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to
2037)
tos
This module matches the 8 bits of Type of Service field in the IP
header (ie. including the precedence bits).
--tos tos
The argument is either a standard name, (use
iptables -m tos -h
to see the list), or a numeric value to match.
ttl
This module matches the time to live field in the IP header.
--ttl-eq ttl
Matches the given TTL value.
--ttl-gt ttl
Matches if TTL is greater than the given TTL value.
--ttl-lt ttl
Matches if TTL is less than the given TTL value.
udp
These extensions are loaded if ‘--protocol udp’ is specified. It pro-
vides the following options:
--source-port [!] port[:port]
Source port or port range specification. See the description of
the --source-port option of the TCP extension for details.
--destination-port [!] port[:port]
Destination port or port range specification. See the descrip-
tion of the --destination-port option of the TCP extension for
details.
unclean
This module takes no options, but attempts to match packets which seem
malformed or unusual. This is regarded as experimental.
2012年3月22日 星期四
IPTABLES MATCH EXTENSIONS
IPTABLES TARGET EXTENSIONS
iptables can use extended target modules: the following are included in
the standard distribution.
BALANCE
This allows you to DNAT connections in a round-robin way over a given
range of destination addresses.
--to-destination ipaddr-ipaddr
Address range to round-robin over.
CLASSIFY
This module allows you to set the skb->priority value (and thus clas-
sify the packet into a specific CBQ class).
--set-class MAJOR:MINOR
Set the major and minor class value.
CLUSTERIP
This module allows you to configure a simple cluster of nodes that
share a certain IP and MAC address without an explicit load balancer in
front of them. Connections are statically distributed between the
nodes in this cluster.
--new Create a new ClusterIP. You always have to set this on the
first rule for a given ClusterIP.
--hashmode mode
Specify the hashing mode. Has to be one of sourceip, sourceip-
sourceport, sourceip-sourceport-destport
--clustermac mac
Specify the ClusterIP MAC address. Has to be a link-layer mul-
ticast address
--total-nodes num
Number of total nodes within this cluster.
--local-node num
Local node number within this cluster.
--hash-init rnd
Specify the random seed used for hash initialization.
CONNMARK
This module sets the netfilter mark value associated with a connection
--set-mark mark[/mask]
Set connection mark. If a mask is specified then only those bits
set in the mask is modified.
--save-mark [--mask mask]
Copy the netfilter packet mark value to the connection mark. If
a mask is specified then only those bits are copied.
--restore-mark [--mask mask]
Copy the connection mark value to the packet. If a mask is spec-
ified then only those bits are copied. This is only valid in the
mangle table.
DNAT
This target is only valid in the nat table, in the PREROUTING and OUT-
PUT chains, and user-defined chains which are only called from those
chains. It specifies that the destination address of the packet should
be modified (and all future packets in this connection will also be
mangled), and rules should cease being examined. It takes one type of
option:
--to-destination ipaddr[-ipaddr][:port-port]
which can specify a single new destination IP address, an inclu-
sive range of IP addresses, and optionally, a port range (which
is only valid if the rule also specifies -p tcp or -p udp). If
no port range is specified, then the destination port will never
be modified.
You can add several --to-destination options. If you specify
more than one destination address, either via an address range
or multiple --to-destination options, a simple round-robin (one
after another in cycle) load balancing takes place between these
adresses.
DSCP
This target allows to alter the value of the DSCP bits within the TOS
header of the IPv4 packet. As this manipulates a packet, it can only
be used in the mangle table.
--set-dscp value
Set the DSCP field to a numerical value (can be decimal or hex)
--set-dscp-class class
Set the DSCP field to a DiffServ class.
ECN
This target allows to selectively work around known ECN blackholes. It
can only be used in the mangle table.
--ecn-tcp-remove
Remove all ECN bits from the TCP header. Of course, it can only
be used in conjunction with -p tcp.
LOG
Turn on kernel logging of matching packets. When this option is set
for a rule, the Linux kernel will print some information on all match-
ing packets (like most IP header fields) via the kernel log (where it
can be read with dmesg or syslogd(8)). This is a "non-terminating tar-
get", i.e. rule traversal continues at the next rule. So if you want
to LOG the packets you refuse, use two separate rules with the same
matching criteria, first using target LOG then DROP (or REJECT).
--log-level level
Level of logging (numeric or see syslog.conf(5)).
--log-prefix prefix
Prefix log messages with the specified prefix; up to 29 letters
long, and useful for distinguishing messages in the logs.
--log-tcp-sequence
Log TCP sequence numbers. This is a security risk if the log is
readable by users.
--log-tcp-options
Log options from the TCP packet header.
--log-ip-options
Log options from the IP packet header.
--log-uid
Log the userid of the process which generated the packet.
MARK
This is used to set the netfilter mark value associated with the
packet. It is only valid in the mangle table. It can for example be
used in conjunction with iproute2.
--set-mark mark
MASQUERADE
This target is only valid in the nat table, in the POSTROUTING chain.
It should only be used with dynamically assigned IP (dialup) connec-
tions: if you have a static IP address, you should use the SNAT target.
Masquerading is equivalent to specifying a mapping to the IP address of
the interface the packet is going out, but also has the effect that
connections are forgotten when the interface goes down. This is the
correct behavior when the next dialup is unlikely to have the same
interface address (and hence any established connections are lost any-
way). It takes one option:
--to-ports port[-port]
This specifies a range of source ports to use, overriding the
default SNAT source port-selection heuristics (see above). This
is only valid if the rule also specifies -p tcp or -p udp.
MIRROR
This is an experimental demonstration target which inverts the source
and destination fields in the IP header and retransmits the packet. It
is only valid in the INPUT, FORWARD and PREROUTING chains, and user-
defined chains which are only called from those chains. Note that the
outgoing packets are NOT seen by any packet filtering chains, connec-
tion tracking or NAT, to avoid loops and other problems.
NETMAP
This target allows you to statically map a whole network of addresses
onto another network of addresses. It can only be used from rules in
the nat table.
--to address[/mask]
Network address to map to. The resulting address will be con-
structed in the following way: All ’one’ bits in the mask are
filled in from the new ‘address’. All bits that are zero in the
mask are filled in from the original address.
NOTRACK
This target disables connection tracking for all packets matching that
rule.
It can only be used in the
raw table.
REDIRECT
This target is only valid in the nat table, in the PREROUTING and OUT-
PUT chains, and user-defined chains which are only called from those
chains. It alters the destination IP address to send the packet to the
machine itself (locally-generated packets are mapped to the 127.0.0.1
address). It takes one option:
--to-ports port[-port]
This specifies a destination port or range of ports to use:
without this, the destination port is never altered. This is
only valid if the rule also specifies -p tcp or -p udp.
REJECT
This is used to send back an error packet in response to the matched
packet: otherwise it is equivalent to DROP so it is a terminating TAR-
GET, ending rule traversal. This target is only valid in the INPUT,
FORWARD and OUTPUT chains, and user-defined chains which are only
called from those chains. The following option controls the nature of
the error packet returned:
--reject-with type
The type given can be
icmp-net-unreachable
icmp-host-unreachable
icmp-port-unreachable
icmp-proto-unreachable
icmp-net-prohibited
icmp-host-prohibited or
icmp-admin-prohibited (*)
which return the appropriate ICMP error message (port-unreach-
able is the default). The option tcp-reset can be used on rules
which only match the TCP protocol: this causes a TCP RST packet
to be sent back. This is mainly useful for blocking ident
(113/tcp) probes which frequently occur when sending mail to
broken mail hosts (which won’t accept your mail otherwise).
(*) Using icmp-admin-prohibited with kernels that do not support it
will result in a plain DROP instead of REJECT
ROUTE
This is used to explicitly override the core network stack’s routing
decision. mangle table.
--oif ifname
Route the packet through ‘ifname’ network interface
--iif ifname
Change the packet’s incoming interface to ‘ifname’
--gw IP_address
Route the packet via this gateway
--continue
Behave like a non-terminating target and continue traversing the
rules. Not valid in combination with ‘--iif’ or ‘--tee’
--tee Make a copy of the packet, and route that copy to the given des-
tination. For the original, uncopied packet, behave like a non-
terminating target and continue traversing the rules. Not valid
in combination with ‘--iif’ or ‘--continue’
SET
This modules adds and/or deletes entries from IP sets which can be
defined by ipset(8).
--add-set setname flag[,flag...]
add the address(es)/port(s) of the packet to the sets
--del-set setname flag[,flag...]
delete the address(es)/port(s) of the packet from the sets,
where flags are src and/or dst and there can be no more than six
of them.
The bindings to follow must previously be defined in order to use
multilevel adding/deleting by the SET target.
SNAT
This target is only valid in the nat table, in the POSTROUTING chain.
It specifies that the source address of the packet should be modified
(and all future packets in this connection will also be mangled), and
rules should cease being examined. It takes one type of option:
--to-source ipaddr[-ipaddr][:port-port]
which can specify a single new source IP address, an inclusive
range of IP addresses, and optionally, a port range (which is
only valid if the rule also specifies -p tcp or -p udp). If no
port range is specified, then source ports below 512 will be
mapped to other ports below 512: those between 512 and 1023
inclusive will be mapped to ports below 1024, and other ports
will be mapped to 1024 or above. Where possible, no port alter-
ation will occur.
You can add several --to-source options. If you specify more
than one source address, either via an address range or multiple
--to-source options, a simple round-robin (one after another in
cycle) takes place between these adresses.
TCPMSS
This target allows to alter the MSS value of TCP SYN packets, to con-
trol the maximum size for that connection (usually limiting it to your
outgoing interface’s MTU minus 40). Of course, it can only be used in
conjunction with -p tcp.
This target is used to overcome criminally braindead ISPs or servers
which block ICMP Fragmentation Needed packets. The symptoms of this
problem are that everything works fine from your Linux firewall/router,
but machines behind it can never exchange large packets:
1) Web browsers connect, then hang with no data received.
2) Small mail works fine, but large emails hang.
3) ssh works fine, but scp hangs after initial handshaking.
Workaround: activate this option and add a rule to your firewall con-
figuration like:
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu
--set-mss value
Explicitly set MSS option to specified value.
--clamp-mss-to-pmtu
Automatically clamp MSS value to (path_MTU - 40).
These options are mutually exclusive.
TOS
This is used to set the 8-bit Type of Service field in the IP header.
It is only valid in the mangle table.
--set-tos tos
You can use a numeric TOS values, or use
iptables -j TOS -h
to see the list of valid TOS names.
TRACE
This target has no options. It just turns on packet tracing for all
packets that match this rule.
TTL
This is used to modify the IPv4 TTL header field. The TTL field deter-
mines how many hops (routers) a packet can traverse until it’s time to
live is exceeded.
Setting or incrementing the TTL field can potentially be very danger-
ous,
so it should be avoided at any cost.
Don't ever set or increment the value on packets that leave your local
network!
mangle table.
--ttl-set value
Set the TTL value to ‘value’.
--ttl-dec value
Decrement the TTL value ‘value’ times.
--ttl-inc value
Increment the TTL value ‘value’ times.
ULOG
This target provides userspace logging of matching packets. When this
target is set for a rule, the Linux kernel will multicast this packet
through a netlink socket. One or more userspace processes may then sub-
scribe to various multicast groups and receive the packets. Like LOG,
this is a "non-terminating target", i.e. rule traversal continues at
the next rule.
--ulog-nlgroup nlgroup
This specifies the netlink group (1-32) to which the packet is
sent. Default value is 1.
--ulog-prefix prefix
Prefix log messages with the specified prefix; up to 32 charac-
ters long, and useful for distinguishing messages in the logs.
--ulog-cprange size
Number of bytes to be copied to userspace. A value of 0 always
copies the entire packet, regardless of its size. Default is 0.
--ulog-qthreshold size
Number of packet to queue inside kernel. Setting this value to,
e.g. 10 accumulates ten packets inside the kernel and transmits
them as one netlink multipart message to userspace. Default is
1 (for backwards compatibility).
訂閱：
意見 (Atom)
How to repair and clone disk with ddrescue
ddrescue is a tool that can be used to repair and clone disks on a Linux system . This includes hard drives, partitions, DVD discs, flas...
-
From: http://blog.chinaaet.com/justlxy/p/5100064818 SMI：串行管理接口（Serial Management Interface），通常直接被稱為MDIO接口（Management Data Input/Output I...
-
from: https://www.wpgdadatong.com/tw/blog/detail?BID=B0594 一. PHY包含的各個子層 ： PCS：編碼和解碼 PMA：串行器和反序列化器 PMD：取決於物理介質 Firgure 1: OSI模型裡示意...
-
在 前面我們所談的那些可以說是比較基本的東西，但是對於一份文件來說，光有前面所介紹的游標移動、刪除等等功能是不足夠的。面對一份文件我們通常會因為某些 緣故而使得我們必須去修改當中固定出現的字串樣式(pattern)成我們想要的樣子。最常遇到的就像中文文件的標點符號問題，或是 un...
