Take the 2-minute tour ×

I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.

One line of my log looks something like this:

Nov 29 17:00:00 IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=53 ID=37898 DF PROTO=TCP SPT=57755 DPT=8888 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204057D010303010101080A3E521D4D0000000004020000)

I would like to understand how to interpret the OPT string (bold).

  • Is there some documentation available on what it actually means?
  • How could I make it human-readable?
share|improve this question
"How could I make it human-readable" is too open-ended for this site. Now that you have the documentation, take a shot at making it human readable yourself and ask another question if you get stuck. We have no idea what tools you have available/are comfortable with, what format you consider acceptable, or where you want the transform to take place. You're both asking us to BOTH do your work for you and mind-read what work you want done. –  Mark Dec 12 '12 at 14:09
add comment

3 Answers

up vote 3 down vote accepted

From a sans.org study guide,
the first 2 bytes (0x0204) 04--is-length 02 means MSS flag
the next 2 bytes (0x057D) are the value for maximum size segment (MSS)
the next byte (0x01) is a no-op
the next 2 bytes (0x0303) indicate a windows scaling is enabled

the 3 bytes ("010101") are no-ops (AKA padding)
the 2 next bytes ("080a") flag a time stamp value
the 4 next bytes (("0x3E521D4D00000000") are date time 5 * 2 bytes
the 4 next bytes ("0402") sAck Ok

The master document: ftp://ftp.ietf.org/iana/tcp-parameters/tcp-parameters.xml
Others: http://tools.ietf.org/html/draft-ietf-tcpm-tcp-security-03

for humor! : http://tools.ietf.org/html/rfc5841

share|improve this answer
add comment

The RFC 791 defines the IPv4 protocol. In section 3.1, starting at page 15, there is an explanation about the OPTIONS field.

Source : RFC 791

share|improve this answer
Thanks, could you maybe provide some example based on my output to make it human-readable? –  alex Dec 6 '12 at 15:35
add comment

This is the options part of the TCP header.

Look here for detailed information.

share|improve this answer
Hm, I already know about the OPT header itself and also what it does. Could you elaborate on how I would parse such a sting and give an example based on my output? –  alex Dec 6 '12 at 14:59
BTW, Wikipedia is not an credible and/or official source. –  alex Dec 6 '12 at 15:02
Is this a statement of yours or has this been discussed on the stackexchange network? –  Christophe Drevet Dec 6 '12 at 15:16
well, if you dont believe what you read at wikipedia, then you can check the source (also referred to in the wiki section) here: tools.ietf.org/html/rfc793 And no, i dont want to do your work, that not the point of this site. if you know how it works, take your time and parse the output yourself. –  randoms Dec 6 '12 at 21:52
add comment

Your Answer


