Re: layer7 problem

["Antonio Pérez" <aperlu@telefonica.net>]

Jörg Harmuth wrote:

>Antonio Pérez schrieb:
>  
>
>>Hi Joerg,
>>
>>Thanks for your reply, I also tried PREROUTING and also many different
>>protocols, not only http and the problem remains the same, everything
>>seems to work properly, no errors, but the number of marked packets
>>remains empty.
>>Any idea will be apreciated, thanks.
>>    
>>
>
>Could you please post the output of iptables-save ? I assume, that some
>other rules are the culprit ;)
>
>Have a nice time,
>
>Joerg
>
>
>  
>
iptables-save
# Generated by iptables-save v1.3.3 on Wed Aug 24 14:05:01 2005
*mangle
:PREROUTING ACCEPT [633:402628]
:INPUT ACCEPT [633:402628]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [606:91422]
:POSTROUTING ACCEPT [606:91422]
-A PREROUTING -m layer7 --l7proto http -j MARK --set-mark 0x1
-A PREROUTING -m layer7 --l7proto dns -j MARK --set-mark 0x1
-A POSTROUTING -m layer7 --l7proto http -j MARK --set-mark 0x1
-A POSTROUTING -m layer7 --l7proto dns -j MARK --set-mark 0x1
COMMIT
# Completed on Wed Aug 24 14:05:01 2005


iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 637 packets, 403K bytes)
 pkts bytes target     prot opt in     out     source               
destination
    0     0 MARK       all  --  any    any     anywhere             
anywhere            LAYER7 l7proto http MARK set 0x1
    0     0 MARK       all  --  any    any     anywhere             
anywhere            LAYER7 l7proto dns MARK set 0x1

Chain INPUT (policy ACCEPT 637 packets, 403K bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain OUTPUT (policy ACCEPT 610 packets, 91630 bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain POSTROUTING (policy ACCEPT 610 packets, 91630 bytes)
 pkts bytes target     prot opt in     out     source               
destination
    0     0 MARK       all  --  any    any     anywhere             
anywhere            LAYER7 l7proto http MARK set 0x1
    0     0 MARK       all  --  any    any     anywhere             
anywhere            LAYER7 l7proto dns MARK set 0x1


 I applied layer7 patch to kernel and iptables, do I need to add any 
other path?

Thanks again.