3
1
I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work:
sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm -m string --string "def" --algo bm
This doesn't work, it only works if the packet contains the string "abcdef", but the packet i wish to queue contains the strings at two different locations. Then I tried another method:
sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm
sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "def" --algo bm
But this time it works like "or", it queues packets with string "abc" or "def".
I would have expected the first solution to work, since multiple
-m
are normally combined with anAND
... and I can't find any reference of using regexp in the pattern. I'd say you just can't do it :/ – m4573r – 2012-10-02T08:04:42.150I can do this, but only at application level. By analyzing the queued packets matching any one string, and then matching for second string in my netfilter_queue C module. This method is definitely slower. – adnan kamili – 2012-10-02T10:06:25.257