Re: layer7 problem

["Antonio Pérez" <aperlu@telefonica.net>]

Jörg Harmuth wrote:

>Antonio Pérez schrieb:
>  
>
>>Hello,
>>I want to use layer7 in my linux box. I have the 2.6.12.5 kerner version
>>and the 1.3.3 iptables version. I patched the kernel and the iptables
>>with kernel-2.6.11-layer7-1.4.patch, linux-2.6.9-imq1.diff,
>>iptables-1.3.0-imq1.diff and iptables-layer7-1.4.patch.
>>When i run:
>>iptables -t mangle -A POSTROUTING -m layer7 --l7proto http -j MARK
>>--set-mark 3
>>no error show, but when i do:
>>iptables -t mangle -L -v
>>pkts bytes target     prot opt in     out     source              
>>destination
>>   0     0 MARK       all  --  any    any     anywhere            
>>anywhere            LAYER7 l7proto http MARK set 0x3
>>the packets marked always is 0.
>>    
>>
>
>There are several possibilities - in theory. Taken from http.pat:
>
># this intentionally catches the response from the server
># rather than the request so that other protocols which use
># http (like kazaa) can be caught based on specific http requests
># regardless of the ordering of filters...
># also matches posts
>
>So, if the pattern catches the *server* response, it will be in the 5th
>packet of the connection (3 packets handshake, request, response) and
>this packet will not pass POSTROUTING. It will pass PREROUTING, as it is
>an incoming packet. Thus the best bet is to move your rule accordingly
>or simply add it in PREROUTING.
>
>HTH and have a nice time,
>
>Joerg
>
>  
>

Hi Joerg,

 Thanks for your reply, I also tried PREROUTING and also many different 
protocols, not only http and the problem remains the same, everything 
seems to work properly, no errors, but the number of marked packets 
remains empty.
 Any idea will be apreciated, thanks.

Antonio.