Is checking broken TCP packets still a thing?

Alexis Wilke

11/15/23, 10:36 PM

I often see samples of IPv4 rules for iptables which are there to stop what is viewed as invalid or broken TCP packets. Certain combinations of TCP flags should never be used.

Here is an example of 4 such rules:

-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ALL ACK
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ALL RST
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ALL ACK,FIN
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ALL ACK,PSH

I used these to see how many such invalid packets I receive (i.e. notice the lack of a target, no -j DROP).

If I insert that at the very beginning of the INPUT table, I see a ton of those errors.

When I insert them after the ESTABLISHED,RELATED rule:

-A INPUT -p tcp -m state --state ESTABLISHED,RELATED -m tcp ! --syn -j ACCEPT

I see no errors at all... meaning that those broken TCP packets are being sent to the service the client is connected to.

I am thinking that blocking such is rather futile/unnecessary. Especially, I use the INVALID state first anyway:

-A INPUT -m state --state INVALID -j DROP

and I would imagine that is enough to eliminate really dangerous packets.

What is the consensus about those 4 rules blocking broken TCP packets?

215

0 + 3

firewall

iptables

tcp

Tero Kilkanen

11/16/23, 8:40 PM

When your device is a firewall for other devices, then these rules could provide some value. I think Linux networking stack is good enough to handle the packets properly, so having those rules for packets destined to the box running firewall isn't relevant.

Joel C

11/17/23, 3:54 AM

Why do you believe those rules would catch invalid/broken packets? I'm not a TCO wizard, but those all look like perfectly valid flag sets to me.

Alexis Wilke

11/19/23, 4:05 AM

@JoelC [Here](https://unix.stackexchange.com/questions/651646) is an example on Unix & Linux. [This web page](https://kromey.us/2016/08/setting-up-an-iptables-firewall-part-5-810.html) has rules called "attacks". Do you need more?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is checking broken TCP packets still a thing?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.