Re: Shouldn't this rule catch all packets

[jwlargent <jwlargent@vlsmaps.com>]

Petr Pisar wrote:
> On 2006-12-14, jwlargent <jwlargent@vlsmaps.com> wrote:
>   
> > I was trying to debug some errors in my iptables setup so I added the 
> > following rules to my OUTPUT, just to see what packets were going out.
> > iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
> > iptables -A OUTPUT -j ACCEPT
> >
> > When I do iptables -L OUTPUT -v it shows some packets are falling 
> > through to the last rule.
> > Shouldn't the first rule catch all the packets?
> >
> >     
> No. There exists forth state called INVALID. E.g. TCP packet with ACK
> witch is not part of any tracked TCP connection is INVALID. Naturally,
> INVALID packets are ill packets and they shoudn't appear, but the reality
> is different.
>
> -- Petr
>
>   
So I put in a log rule for --state INVALID and sure enough thats what it 
was.
The packets are part of my ssh connection, tcp with ACK.

IN= OUT=eth0 SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=276 TOS=0x10 
PREC=0x00 TTL=64 ID=1146 DF PROTO=TCP SPT=22 DPT=38858 WINDOW=3228 
RES=0x00 ACK PSH URGP=0