Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a program which uses libpcap to capture incoming TCP SYN packets, these SYN packets are destined for a specific port.

But I have no tcp listening socket for that port, so in practice, the OS Kernel(it is the kernel or the tcp stack? I'm not sure, can anyone tell me) will issue a RST to the source ip of the TCP SYN.

now I want to prevent the RST, I don't want the RST to be sent to the source ip. I think maybe iptables can do this? so how to set the rules with iptables to prevent these RSTs (which are triggered by incoming TCP SYN for a specific port)?

if there are other better solutions, that's better! thanks!

share|improve this question
    
Why do you want to break the TCP protocol ? – BatchyX Apr 18 '13 at 16:38
    
I'm doing a research work, which requires this. – misteryes Apr 18 '13 at 16:55
up vote 1 down vote accepted

A rather basic inbound blocking setup is this:

# Set default policy to 'drop everything'
iptables -P INPUT DROP
# Allow lo traffic
iptables -A INPUT -i lo -j ACCEPT
# Allow icmp
iptables -A INPUT -p icmp -j ACCEPT
# Allow packets sent in response to an outgoing connection
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow outgoing connections
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

This should drop all attempts of establishing a connection to your host.

If you want to be more specific, try adding one of these:

# Block request from being handled further by the TCP stack
iptables -A INPUT -p tcp --dport <port> -j DROP
# Send an ICMP 'administratively prohibited' response
iptables -A INPUT -p tcp --dport <port> -j REJECT
# Don't send any RESETs upon a request to this port
iptables -A OUTPUT -p tcp -o <outgoing interface> --sport <port> --tcp-flags RST RST -j DROP
share|improve this answer
    
ah, I got it, you mean I can still capture the incoming tcp SYN using libpcap or tcpdump. Just they are not delivered to the TCP stack, so the TCP stack won't issue a RST, is it right? – misteryes Apr 18 '13 at 17:20
    
Correct. libpcap intercepts packets earlier. – fuero Apr 18 '13 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .