Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just noticed an entry in /etc/sysconfig/iptables along the lines of -A INPUT -p tcp -m tcp --dport 138 -j DROP

I am not so sure why there has to be two switches here for matching protocol TCP, that is, -p tcp and -m tcp. Is there any difference between them?

share|improve this question

-p The protocol of the rule or of the packet to check.

The specified protocol can be one of tcp, udp, icmp, or all, or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. Protocol all will match with all protocols and is taken as default when this option is omitted.

-m Specifies a match to use, that is, an extension module that tests for a specific property.

The set of matches make up the condition under which a target is invoked. Matches are evaluated first to last as specified on the command line and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

Added info

-m Also matches packets of the specified protocol name. If '!' precedes the protocol name, this matches all packets that are not of the specified protocol. Valid protocol names are icmp, udp, tcp... A list of all the valid protocols could be found in the file /etc/protocols. So I think it would be safe to omitt the -m

Source:IPtables ManPage

share|improve this answer
Thanks for the answer. I know now that -p tcp is used to check for tcp packets, but what about -m tcp ? Is it used to check some TCP extension module? – xczzhh Sep 23 '13 at 14:17
And also, I see in some place that -m tcp is omitted... can it always be omitted? – xczzhh Sep 23 '13 at 14:20
See added info in the answer. – Mitch Sep 23 '13 at 14:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.