netman大哥您好
我看了一下how to那篇原文,內容的確是這樣:
--tcp-flags
Followed by an optional `!', then two strings of flags, allows you to filter on specific TCP flags. The first string of flags is the mask: a list of flags you want to examine. The second string of flags tells which one(s) should be set. For example,
# iptables -A INPUT --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
This indicates that all flags should be examined (`ALL' is synonymous with `SYN,ACK,FIN,RST,URG,PSH'), but only SYN and ACK should be set. There is also an argument `NONE' meaning no flags.
--syn
Optionally preceded by a `!', this is shorthand for `--tcp-flags SYN,RST,ACK SYN'.
後來我去翻了一下字典,optional的意思是"可有可無的"或"隨意的"意思,所以我覺得,第一句的意思,是否應該是這樣:
--tcp-flags
"--tcp-flags"之後先接著一個可有可無的 "!"(此驚嘆號代表"not",我覺得optional是說可接著也可不接著一個"!"),然後(我覺得"then"在這裡應該是這個意思)再接著兩個旗標字串(這裡在 two strings of flags前面沒有optional這個字,意思是強制性的非有這兩個旗標字串不可). 這個--tcp-flags的延伸
能讓你過濾特定的TCP旗標.
我覺得這一句,若以分詞構句來講,allow的主詞應該是
"--tcp-flags",而不是"two strings of flags"
請netman大哥看一下這個例子
Followed by some coffee,then some soft drinks,I ate a lot of food.
不知道小弟看法是否有錯誤,還望各位大大能指正一二