On Fri, Dec 07, 2001 at 02:20:50PM +0800, yangrunhua wrote: > If I don't want to use ip packet content(such as normally used) You cannot. The packet fwmark lives in the skb and not in the packet, so u32 can't 'see' it. Regards, bert -- http://www.PowerDNS.com Versatile DNS Software & Services Trilab The Technology People Netherlabs BV / Rent-a-Nerd.nl - Nerd Available - 'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet