Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which translates them into a message it displays in its interface. Thing is : these notifications really annoy me.
Since these notifications are nothing vital to the client, I started to analyse my TCP streams coming from the remote server. I noticed an obvious pattern : every time the notifications pops up, 4 specific packets are sent to me. For instance :
Flags [P.], seq 60:297, ack 1, win 257, options [nop, nop, TS val 108022880 ecr 914609], length 237 Flags [.], ack 6, win 257, options [nop, nop, TS val 108022891 ecr 915061], length 0 Flags [P.], seq 297:534, ack 6, win 257, options [nop, nop, TS val 108022891 ecr 915061], length 237 Flags [.], ack 11, win 257, options [nop, nop, TS val 108022904 ecr 915090], length 0
I observed the TCP communication for a while, and let several notifications appear. Here's what I noticed :
- The server always sends 4 packets when requesting the client to "notify" me.
- These packets are always organised in the same order : 237 bytes, 0 byte, 237 bytes, 0 byte.
- The rest of the communication between the server and the client doesn't follow any pattern (except when I repeatedly make the same requests to the client of course).
Since I've been able to identify a pattern, I would now like my machine to detect it when it occurs, and block the associated packets before they reach the client.
I have tried using the size as a blocking parameter using :
iptables -I INPUT -p tcp -s [server-IP] -m length --length 237 -j DROP
Unfortunately, I can stil see the 237-byte-long packets reaching the client... Is there any way I could be specific enough with
iptables, in order to block this particular sequence, without shutting off the whole communication stream ?
Edit : the Don't show disturbing notifications option does not exist in the client, that would be far too easy, wouldn't it ? These notifications are very much like ads.