Hi again,
ok, did some tests:
match ip sport 3128 does work (as does the more correct
match ip sport 3128 0xffff match ip protocol 0xff to only consider
TCP) - match tcp src 3128 does not.
The difference as shown by tc filter show dev eth0 parent ffff:
is that ip sport -> "match 0c380000/ffff0000 at 20"
tcp src -> "match 0c380000/ffff0000 at nexthdr+0".
This confirms my assumption, that nexthrd is broken.
at nexthdr+0 _should_ work with IP options present, "at 20" not,
correct?
Lutz
--
_ | Lutz Pressler | Tel: ++49-551-3700002
|_ |\ | | Service Network GmbH | FAX: ++49-551-3700009
._|ER | \|ET | Bahnhofsallee 1b | mailto:lp@xxxxxxxxx
Service Network | D-37081 Goettingen | http://www.SerNet.DE/
