title: IPTables rule to log then drop packets than contains a hex-string found via TCDUMP
body: <p>Using TCP Dump i captured this packet which is all the time making my software unavailable.</p>
  
  <pre><code>18:56:58.979504 IP Ubuntu-1404-trusty-64-minimal.13333 &gt; XXX.XXX.XXX.XXX.60323: Flags [.], ack 47, win 227, options [nop,nop,TS val 26672837 ecr 695829589], length 0
      0x0000:  f4cc 554b 552c 5404 a6a6 8f40 0800 4500  ..UKU,T....@..E.
      0x0010:  0034 0ac8 4000 4006 25aa b009 6f56 bca5  .4..@.@.%...oV..
      0x0020:  2e4d 2f4f eba3 ffa0 f75a aac5 8dfb 8010  .M/O.....Z......
      0x0030:  00e3 72ad 0000 0101 080a 0196 fec5 2979  ..r...........)y
      0x0040:  8455
  </code></pre>
  
  <p>After several inspections, i noticed that this packet has a fixed part which remain unchanged in every captured packet,this part is situated in the offset <code>0x0010</code> exactley : <code>b009 6f56 bca5</code>.
  First of all i attempt to log this packet when arrived using iptables:</p>
  
  <pre><code>iptables -A INPUT -p tcp --dport 13333 -m string --algo bm --hex-string "|b0096f56bca5|" -j LOG --log-prefix "b009-6f56-bca5:"
  </code></pre>
  
  <p>Unfortunately this iptables rule don't work.But when i changed it to :</p>
  
  <pre><code>iptables -A INPUT -p tcp --dport 13333 -m string --algo bm --hex-string "|bca5|" -j LOG --log-prefix "b009-6f56-bca5:"
  </code></pre>
  
  <p>It work without any issues.
  What is wrong with the 1st rule? I already tried <code>"|b009 6f56 bca5|"</code> without success.</p>
  
  <p>Any help will be appreciated.
  Best regards.</p>