<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">It doesn't matter the length of the packet. <div>That rule will try to find the string "gestatus" starting at position 32 bytes from start of packet and searching for it at maximum at position 41.</div><div>The Q3 protocol for that command expects the string to be in that range.<br><div> <br><div><div>On Feb 24, 2012, at 1:11 AM, Geoff Goas wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Is the offset range of 32-41 based on a 60-byte packet?<br><br><div class="gmail_quote">On Thu, Feb 23, 2012 at 10:34 AM, Marco Padovan <span dir="ltr"><<a href="mailto:evcz@evcz.tk">evcz@evcz.tk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; ">
<div bgcolor="#FFFFFF" text="#000000">
iptables -A INPUT -p udp -m string --string "getstatus"
--algo bm --from 32 --to 41 -j DROP<br>
<br></div></blockquote></div>-- <br><i><b><font size="1"><span style="font-family:tahoma,sans-serif">Geoff Goas</span><br style="font-family:tahoma,sans-serif"><span style="font-family:tahoma,sans-serif">Systems Engineer</span></font></b></i><br>
<br>
_______________________________________________<br>cod mailing list<br><a href="mailto:cod@icculus.org">cod@icculus.org</a><br><a href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a><br></blockquote></div><br></div></div></body></html>