iptables: why use both -p and -m to match the target protocol?

hsegtreas · 06-02-2009, 06:37 PM

The title is the question.. I've seen it a few times, what's the difference between, ie:
iptables -A INPUT -p udp --dport 1234 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1234 -j ACCEPT

The second line has -m specified. It looks like it's the same, but is there an actual difference?
My guess is that when specifying -m, instead of just trusting the IP stack on the protocol, iptables will also analyze the packet headers (?) But then is that really more secure, and does it takes significantly more processor power? Is it worth it?.. Or am i just way off and there's no difference whatsoever?

I'm kinda curious about that.. Does Anyone know?

Thanks,

Vincent

Berhanie · 06-02-2009, 07:19 PM

Quote:

It looks like it's the same, but is there an actual difference?

No. As noted in the iptables man page, specifying the protocol with -p
implicitly loads the match extensions for that protocol, so, e.g., the following are
equivalent:

Code:

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp        --dport 22 -j ACCEPT

From the man page:

Quote:

...
iptables can use extended packet matching modules. These are loaded in
two ways: implicitly, when -p or --protocol is specified, or with the
-m or --match options, followed by the matching module name;
...

hsegtreas · 06-02-2009, 08:20 PM

heh I guess that people who wrote the examples i've seen use the -m out of a habit of loading other modules.. Or maybe just because they don't know its useless..
Anyways, Thanks for the clear explanation Berhanie!

Vincent

Berhanie · 06-02-2009, 10:25 PM

Quote:

-m out of a habit of loading other modules

It's also for consistency of syntax.