nerdexam
GIAC

GSEC · Question #19

What would the following IP tables command do? IP tables -I INPUT -s 99.23.45.1/32 -j DROP

The correct answer is A. Drop all packets from the source address. This iptables command inserts a rule that silently drops all inbound packets originating from the single source IP address 99.23.45.1.

Network Security

Question

What would the following IP tables command do? IP tables -I INPUT -s 99.23.45.1/32 -j DROP

Options

  • ADrop all packets from the source address
  • BInput all packers to the source address
  • CLog all packets to or from the specified address
  • DDrop all packets to the specified address

How the community answered

(14 responses)
  • A
    79% (11)
  • B
    14% (2)
  • C
    7% (1)

Why each option

This iptables command inserts a rule that silently drops all inbound packets originating from the single source IP address 99.23.45.1.

ADrop all packets from the source addressCorrect

The -I INPUT flag inserts a rule at the top of the INPUT chain, which processes inbound traffic destined for the local host. The -s 99.23.45.1/32 specifies the source IP with /32 CIDR notation targeting a single host, and -j DROP silently discards all matching packets. Together these flags block all incoming traffic from that specific source address.

BInput all packers to the source address

The -I flag inserts a rule into a chain and does not forward or deliver packets to an address - there is no iptables action that 'inputs packets to' a destination.

CLog all packets to or from the specified address

Logging in iptables requires the -j LOG target; this command uses -j DROP, which silently discards packets without generating any log entries.

DDrop all packets to the specified address

The -s flag specifies the source address, not the destination; to match destination traffic the -d flag is used, so this rule affects traffic coming FROM 99.23.45.1, not traffic going TO it.

Concept tested: iptables INPUT chain source-based packet drop rule

Source: https://www.man7.org/linux/man-pages/man8/iptables.8.html

Topics

#iptables#packet filtering#firewall rules#source IP blocking

Community Discussion

No community discussion yet for this question.

Full GSEC Practice