mark match

mark match

[Gabriel Kujawski]

Hi,
I mark packets this way:
iptables -t mangle -I PREROUTING -p icmp -s 192.168.0.2 -d 0/0 -j MARK 
--set-mark 0x2
This workes correctly.
Next I try to log these marked packets with ULOG target:
iptables -t mangle -I POSTROUTING -m mark --mark 0x2 -j ULOG 
--ulog-nlgroup 1 --ulog-prefix MARKtest
but this rule doesn't work.
However, if I use FORWARD chain packets are logged.
Could you tell me the reason?

mark match

[Peteris Krumins]

hi,

 what's the point of mask in the mark match?
 
 for example, i want to match anything marked from 1 (1b) to
 127 (1111111b), is it possible to do it using a mask?

 nfmark    mask    match
 1      &  127  =  1
 77     &  127  =  77

 i see no point in mask.
 could anyone explain the use of mask to match multiple nfmarks?

P.Krumins

Re: mark match

[Cedric Blancher]

Le sam 29/03/2003 à 14:25, Peteris Krumins a écrit :
>  for example, i want to match anything marked from 1 (1b) to
>  127 (1111111b), is it possible to do it using a mask?
> 
>  nfmark    mask    match
>  1      &  127  =  1
>  77     &  127  =  77

To be valuable, a mask has to have some low bits to 0. If all mask's
bits are set to 1, than it only matches the masked value... For your
purpose, you have to use 128 (10000000b) as mask :

	1    & 128 = 0
	77   & 128 = 0
	128  & 128 = 128
	129  & 128 = 128

So, you match 0, with a 128 mask, which may be, I guess, something like
"-m mark --mark 0/128".

Note that 0 will also match.

It is basicly the same system as netmasks.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE