被攻击实例:请教ESTABLISHED方式的如何用iptables来防

zzw45

1、请教下面一句话是什么意思？
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


2、请教如果防止如下攻击
###################################
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1392 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1360 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1456 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1424 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1393 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1361 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1457 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1425 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1394 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1362 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1458 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1426 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1395 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1363 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1427 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1396 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1364 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1428 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1397 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1365 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1429 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:4662 TIME_WAIT
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1398 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1366 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1430 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:4663 TIME_WAIT
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1399 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1367 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1431 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1400 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1368 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1432 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1401 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1369 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1433 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1402 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1370 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1434 ESTABLISHED
tcp 0 0 ::ffff:61.129.53.112:80 ::ffff:221.224.114.195:1403 ESTABLISHED
###################################

ayazero

1
第一句是为了放行维持完整连接需要的其他状态的包，比如由自己发出服务端返回的应答包，当前消息队列的后续包，TCP SYN以外的包等……

2
connection flood最多用iptables写一条规则limit状态触发一个burst

[ 本帖最后由 ayazero 于 2005-11-28 12:58 编辑 ]