Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a program which uses libpcap to capture incoming TCP SYN packets, these SYN packets are destined for a specific port.

But I have no tcp listening socket for that port, so in practice, the OS Kernel(it is the kernel or the tcp stack? I'm not sure, can anyone tell me) will issue a RST to the source ip of the TCP SYN.

now I want to prevent the RST, I don't want the RST to be sent to the source ip. I think maybe iptables can do this? so how to set the rules with iptables to prevent these RSTs (which are triggered by incoming TCP SYN for a specific port)?

if there are other better solutions, that's better! thanks!

share|improve this question
    
Why do you want to break the TCP protocol ? –  BatchyX Apr 18 '13 at 16:38
    
I'm doing a research work, which requires this. –  misteryes Apr 18 '13 at 16:55

1 Answer 1

up vote 1 down vote accepted

A rather basic inbound blocking setup is this:

# Set default policy to 'drop everything'
iptables -P INPUT DROP
# Allow lo traffic
iptables -A INPUT -i lo -j ACCEPT
# Allow icmp
iptables -A INPUT -p icmp -j ACCEPT
# Allow packets sent in response to an outgoing connection
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow outgoing connections
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

This should drop all attempts of establishing a connection to your host.

If you want to be more specific, try adding one of these:

# Block request from being handled further by the TCP stack
iptables -A INPUT -p tcp --dport <port> -j DROP
# Send an ICMP 'administratively prohibited' response
iptables -A INPUT -p tcp --dport <port> -j REJECT
# Don't send any RESETs upon a request to this port
iptables -A OUTPUT -p tcp -o <outgoing interface> --sport <port> --tcp-flags RST RST -j DROP
share|improve this answer
    
ah, I got it, you mean I can still capture the incoming tcp SYN using libpcap or tcpdump. Just they are not delivered to the TCP stack, so the TCP stack won't issue a RST, is it right? –  misteryes Apr 18 '13 at 17:20
    
Correct. libpcap intercepts packets earlier. –  fuero Apr 18 '13 at 18:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.