I'm trying to create a iptables rule that matches the following pattern in this UDP packet:
0x0000: 0000 030a 0000 0000 0000 0000 0000 0800 ................
0x0010: 4500 0027 5d30 0000 6c11 232a 5164 585d E..']0..l.#*QdX]
0x0020: c0a8 6402 fe25 1e61 0013 b382 5341 4d50 ..d..%.a....SAMP
0x0030: c063 ba71 e2ea 63 .c.q..c
The pattern is |53414d50c063ba71|
followed by a random hex, in this case |e2ea|
, followed by |63|
.
The rule has to assure that there are 4 digits after the |53414d50c063ba71|
, and that after those 4 random digits, there is a |63|
.
Right now I have this, but I don't know how to modify it accordingly:
iptables -I INPUT -p udp --dport 7777 -m string --algo kmp \
--hex-string '|53414d50c063ba71????63|' -j DROP
???? -> How??
Please help me.