Block specific packets/sequences of packets to remove disturbing client "feature"

Question

Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which translates them into a message it displays in its interface. Thing is : these notifications really annoy me.

Since these notifications are nothing vital to the client, I started to analyse my TCP streams coming from the remote server. I noticed an obvious pattern : every time the notifications pops up, 4 specific packets are sent to me. For instance :

Flags [P.],  seq 60:297,                 ack 1,          win 257,    options [nop,  nop,    TS val 108022880 ecr 914609],    length 237
Flags [.],                               ack 6,          win 257,    options [nop,  nop,    TS val 108022891 ecr 915061],    length 0
Flags [P.],  seq 297:534,                ack 6,          win 257,    options [nop,  nop,    TS val 108022891 ecr 915061],    length 237
Flags [.],                               ack 11,         win 257,    options [nop,  nop,    TS val 108022904 ecr 915090],    length 0

I observed the TCP communication for a while, and let several notifications appear. Here's what I noticed :

• The server always sends 4 packets when requesting the client to "notify" me.
• These packets are always organised in the same order : 237 bytes, 0 byte, 237 bytes, 0 byte.
• The rest of the communication between the server and the client doesn't follow any pattern (except when I repeatedly make the same requests to the client of course).

Since I've been able to identify a pattern, I would now like my machine to detect it when it occurs, and block the associated packets before they reach the client.

I have tried using the size as a blocking parameter using :

iptables -I INPUT -p tcp -s [server-IP] -m length --length 237 -j DROP

Unfortunately, I can stil see the 237-byte-long packets reaching the client... Is there any way I could be specific enough with iptables, in order to block this particular sequence, without shutting off the whole communication stream ?

Edit : the Don't show disturbing notifications option does not exist in the client, that would be far too easy, wouldn't it ? These notifications are very much like ads.

Answer 1

No. If you drop packets from the middle of a connection, the server will resend those packets until they succeed. If they don't succeed for a sufficiently long time, the server will assume the entire connection has failed and will close the connection.

The reason your IPTables rule is not matching is that IPTables matches against the entire packet length, whereas your 237 bytes is the length of the data in the TCP packet. The full packet length is at least 20 bytes longer (may be more, depending on TCP options).

You could proxy the connection and actually remove the message at the application layer, but that'd depend on the protocol in use.