I have the following rule in our iptables config file /etc/sysconfig/iptables
-A INPUT -s 84.23.99.97 -j DROP
And when I do iptables --list I get the following
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- 84.23.99.97 anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
However, if I do a tcpdump I can still see all these traffic from this ip, why?
tcpdump -ttttn tcp port 1234 | grep 84.23.99.97
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
2010-10-21 23:49:33.828011 IP 84.23.99.97.9061 > myip: Flags [S], seq 3522466008, win 65535, options [mss 1460,sackOK,eol], length 0
2010-10-21 23:49:33.832182 IP 84.23.99.97.64804 > myip: Flags [S], seq 1088176500, win 65535, options [mss 1460,sackOK,eol], length 0
....