On Fri, Dec 14, 2001 at 03:15:43PM +0200, Julian Anastasov wrote: > > Damn, that's broken. Or at least, extremely non-obvious and hard to get > > working. Overly universal comes to mind. So 'ip sport' would stop matching > > packets with ip options? > > No, ihl includes the options. Everything works perfectly. > It is bug to use sport and dport if ip options are present. There Geh. Or an 'undocumented feature'. Because you don't know what kind of packets you will send or forward, using 'ip sport' is always a bug. > are tcp dst and tcp src for example. Same for udp. For icmp there > are icmp type and icmp code. All they use the same base pointer. But tcp src only works when operating in a hashed filter? Which is not often the case. I tried this: tc filter add dev eth0 parent 1:0 prio 5 u32 \ match ip nofrag \ offset mask 0x0F00 shift 6 \ match tcp src 22 0xffff classid 1:2 But it doesn't work, gives: RTNETLINK answers: Invalid argument Regards, bert -- http://www.PowerDNS.com Versatile DNS Software & Services Trilab The Technology People Netherlabs BV / Rent-a-Nerd.nl - Nerd Available - 'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet
