length match problem

Ok I have the following problem.

iptables -A OUTPUT -o ppp0 -p tcp -m length --length :40 -j MARK --set-mark 10

That should mark all ACK's or not ?

When I try to do this I get the error:

iptables: Invalid argument

I found out that this has something to do with the length match.
Because not used I don't get an error message. I looked around and found an example in netfilter-extensions-HOWTO with icmp:

iptables -A INPUT -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP

When I try to do something like this it doesn't work too :(

So now my question is what am I doin wrong ?

Sorry I'm not an iptables guy an I only tried a script from somewhere else. But this one line doesn't work.

anyone can help me ?

Thx

Joerg Esser

Hello Joerg,

Typically when the only error message from iptables is 'Invalid Argument', the actual error message would be most of the time in the kernel log.
i.e. If I run your command above, it tells me

# dmesg
MARK: can only be called from "mangle" table, not "filter"

So, you should be using a -t mangle in front..

Have a nice day,

Fabrice.
--
Fabrice MARIE

"Silly hacker, root is for administrators"
-Unknown

Hmm forget to look there (Just a newbie ;)

Thx that did it.

You too.