0

I want to block traffic that contain specific string "anypattern".

I know that the right iptables rule for that is:

iptables -m string --algo bm --string "anypattern" -j DROP

The problem that the data could be split to many TCP sequences. And there is a risk that the string "anypattern" could be split in 2 packets. For example the packet 1 will contains "anyp" and the second packet will contains "attern"

How I can make iptables detect TCP fragmentation and make the check on the final tcp payload? Or are there a solution for such issue?

Improve this question

1 Answer 1

Reset to default
1

It is not possible to span multiple packets with any iptables rule, they apply on a per packet basis. Reassembling multiple packets into an overall payload happens at higher level, after iptables handles the packets.

Improve this answer
1
  • could be done by DPI modules or by IDS but unfortunally not with iptables
    – Mohamed KALLEL
    Jan 23, 2020 at 7:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .