* Jan Engelhardt wrote, On 08/03/07 20:26: > xt_portscan needs to keep track of what packets the machine has already > seen. So on the first SYN, the connection is marked with "1". (Then we > send our SYN-ACK... and the connection turns ESTABLISHED.) The next > packet that is received will be an ACK or an RST. But it must come > _exactly after_ the SYN, so just using --tcp-flags ACK will not work. A > state which can be remembered is required. For that, an automaton is > used, whose state is saved in the connection mark.
There would me more point in having this as a new match if it didn't trample on the connection mark, but used it's own slot or flag-bit. Sam - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
