被攻击实例:请教ESTABLISHED方式的如何用iptables来防

zzw45

1、请教下面一句话是什么意思？\r\n# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\r\n\r\n\r\n2、请教如果防止如下攻击\r\n###################################\r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1392 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1360 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1456 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1424 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1393 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1361 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1457 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1425 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1394 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1362 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1458 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1426 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1395 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1363 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1427 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1396 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1364 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1428 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1397 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1365 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1429 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:4662 TIME_WAIT \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1398 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1366 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1430 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:4663 TIME_WAIT \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1399 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1367 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1431 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1400 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1368 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1432 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1401 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1369 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1433 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1402 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1370 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1434 ESTABLISHED \r\ntcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1403 ESTABLISHED \r\n###################################

ayazero

1\r\n第一句是为了放行维持完整连接需要的其他状态的包，比如由自己发出服务端返回的应答包，当前消息队列的后续包，TCP SYN以外的包等……\r\n\r\n2\r\nconnection flood最多用iptables写一条规则limit状态触发一个burst\n\n[ 本帖最后由 ayazero 于 2005-11-28 12:58 编辑 ]