> > iptables -A INPUT -p tcp -m --mport 80 -m --string "bad" -j DROP > > What happens here when 'b' and 'ad' are fragmented into two packets? You do not get a match, the rule fails :)
I think we should write it down to some faq or howto that to acomplish that we would have to have a HTTP decoder, and that is not the aim of this project. > Ramin Maciek
