ip包过滤常用规则

最新推荐文章于 2021-09-23 17:24:47 发布

lepton126

最新推荐文章于 2021-09-23 17:24:47 发布

阅读量2.2k

点赞数 1

分类专栏：安全运维文章标签： ip filter

本文链接：https://blog.csdn.net/lepton126/article/details/79493422

版权

本文详细探讨了IP包过滤的工作原理，重点介绍了如何设置和应用常见的过滤规则，以确保网络的安全性和流量管理。内容涵盖了基本的允许和拒绝规则，以及更复杂的基于端口、协议和来源地址的过滤策略。

摘要由CSDN通过智能技术生成

www.wireshark.org/tools/string-cf.html

IP Filters

ip[0] & 0x0f	low nibble: header length in 4octet words. should be 5
ip[1]	type of service/QoS/DiffServ
ip[2:2]	total length of datagram in octets
ip[4:2]	IP ID number
ip[6] & 0x80	reserved bit (possibly used for ECN)
ip[6] & 0x40	DF bit
ip[6] & 0x20	MF bit
ip[6:2] & 0x1fff	fragment offset (number of 8octet blocks)
ip[8]	ttl
ip[9]	protocol
ip[10:2]	header checksum
ip[12:4]	source IP
ip[16:4]	destination IP
Samples
(ip[12:4] = ip[16:4])	Src IP = Dest IP (land attack)
ip[0] & 0xf0	high nibble: IP version. almost always 4
(ip[0] & 0xf0 != 0x40)	IP versions !=4
(ip[0:1] & 0x0f > 5)	IP with options set
(ip[19] = 0xff)	Broadcasts to x.x.x.255
(ip[19] = 0x00)	Broadcasts to x.x.x.0
(ip and ip[1] & 0xfc == 0xb8)	search for EF in DSCP
(ip and ip[1] & 0xfc == 0x28)	search for AF11 in DSCP
(ip and ip[1] & 0xfc != 0x00)	search for DCSP Packets != 0