Skip to contentSkip to conversation

--and-mark while matching?

DISCUSSION Aaron Lewis 2 participants 2 messages Feb 12, 2013

lore
Share & tools
lore

Aaron Lewis

author
#0 lore raw

Hi,

Looks like the mark module doesn't support "and" matching mechanism,

iptables -I INPUT -m mark --and-mark 0x20 -j REJECT

I want to match the packet when the mark has all bit of 0x20 set, possible?

Signature · 3 lines
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://pgp.mit.edu/ )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
#1 lore raw

iptables -I INPUT -m mark --mark 0x20/0x20 -j REJECT

See the description of the mark match. If you specify "-m mark --mark A/B", the mark is first and'ed with B and then the result is checked for equality to A.

Quoted 17 lines · Aaron Lewis

Hi,

Looks like the mark module doesn't support "and" matching mechanism,

iptables -I INPUT -m mark --and-mark 0x20 -j REJECT

I want to match the packet when the mark has all bit of 0x20 set, possible?

--
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://pgp.mit.edu/ )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E --
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html