Hi, The following feature was submitted some months ago. It forces the dump of mark during the connection destruction event. The induced load is quiet small and the patch is usefull to provide an easy way to filter event on user side without having to keep an hash in userspace. This new version is against 2.6.24 git tree. BR, -- Eric Leblond NuFW, Now User Filtering Works : http://www.nufw.org