Red Hat Enterprise Linux 5 Administration Unleashed

492CHAPTER 24Configuring a FirewallstateAllows access to connection tracking state for packets when used with connectiontracking.--state Replace with comma-separated list of connection states to match. Validstates are INVALID, ESTABLISHED, NEW, and RELATED. Refer to the conntrack entryfor a description of the states.stringMatches a user-defined string by using one of two pattern matching strategies.--algo Replace with bm to use the Boyer-Moore pattern matching strategy.Replace with kmp to use the Knuth-Pratt-Morris pattern matchingstrategy.--from If set, start looking for a match after the defined offset. If not set, it starts at 0.--to If set, the offset is the length it looks for a match. If not set, the entire packet sizeis used to match the string.--string Pattern to match.--hex-string Pattern to match in hex notation.tcpIf -p tcp is used, the following options can be used:--source-port [!] :TCP source port or port range to match. The port can be the service name or aport number.--destination-port [!] :TCP destination port or port range to match. The port can be the service name ora port number.--tcp-flags [!] Match TCP flags listed. should be a comma-separated list of flags to lookat, and should be a comma-separated list of flags that must be set. Tomatch, the flags in the list but not in must be unset and the flagsin both lists must be set. Valid flags are SYN, ACK, FIN, RST, URG, PSH, ALL, andNONE.