i was having a strange behaviour marking packets in a new and updated router with kernel 2.6.29 and iptables 1.4.3 using an old script , while it worked just fine on an old router. Trying to debug i found out this: # iptables -p udp -t mangle -A PREROUTING -m state --state NEW -j LOG # iptables -nvL PREROUTING -t mangle Chain PREROUTING (policy ACCEPT 1491 packets, 232K bytes) pkts bytes target prot opt in out source destination 34 5042 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 0 level 4 In the logs i can see: [Why are TCP packets being marked by that rule ?] May 2 02:54:01 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=208.67.222.222 LEN=61 TOS=0x00 PREC=0x00 TTL=64 ID=3746 DF PROTO=UDP SPT=40824 DPT=53 LEN=41 May 2 02:54:01 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=74.125.45.18 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63870 DF PROTO=TCP SPT=55145 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 May 2 02:54:02 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=208.67.222.222 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=3964 DF PROTO=UDP SPT=50636 DPT=53 LEN=53 May 2 02:54:02 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=74.125.45.189 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60402 DF PROTO=TCP SPT=41692 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 May 2 02:54:05 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=208.69.36.132 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=18184 DF PROTO=TCP SPT=43497 DPT=995 WINDOW=5840 RES=0x00 SYN URGP=0 May 2 02:54:06 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=74.125.45.18 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=2765 DF PROTO=TCP SPT=47733 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 May 2 02:54:06 OpenWrt user.warn kernel: IN=br-lan OUT= MAC=00:1a:70:fe:62:5c:00:1c:c0:82:25:c8:08:00 SRC=192.168.1.141 DST=74.125.45.18 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=28286 DF PROTO=TCP SPT=47734 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 -- []'s Salatiel "O maior prazer do inteligente é bancar o idiota diante de um idiota que banca o inteligente". -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
