摘要： 系统地介绍了Linux2.4内核对状态检测包过滤技术的支持机制,并且给出了2.4内核中的一种实现方法,即Netfilter+IPconntrack+IPtables体系。同时,就Linux2.4环境中的状态检测包过滤技术无法对某些多连接服务进行状态检测的局限性,提出了一种通过增加协处理模块解决此类问题的方法。

关键词: 包过滤, 状态检测, 防火墙

Abstract: Inthispaper,thesupportingmechanismofLinux2.4kerneltostateinspectionpacketfiltertechnologyisintroduced,andakindofimplementationmethodunder this mechanism is also presented, that is Netfilter+IPconntrack+IPtables architecture. Finally, aiming at the problem that state inspection for some multi-connections services is disable,amethodbytheadditionofcooperativeprocessmoduleisproposedanddiscussed.

中图分类号: 

• TP311