I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED
. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m state --state NEW, ESTABLISHED, RELATED
at all. However, seeking for information I found that there is a fourth state:
INVALID:
A packet which could not be identified for some reason: this includes running out of memory and ICMP errors which don't correspond to any known connection. Generally these packets should be dropped.
I'm wondering whether or not packets with such state are harmful from a security perspective. According to that quote, they should be dropped, but the document didn't explain why.