Hi, I feel current ulogd based accounting has some issues. It provides the account usage during the destroy event. This is an issue for long living connections, like alerting the user when he exceeds the quota. I read the solution from the pdf published by Herald, 2005. Snippet is given below To overcome limitation number one, the accounting process can use a combined event and polling scheme. The granularity of accounting can therefore be configured by the polling interval, and a compromise between performance and accuracy can be made. Current ulogd2 has not yet have the functionality. The reason is, polling based accounting does not provide any unique id for a particular connection. So even if we generate polling based data and event based data, there is no way to combine the data. If you guys already thought about solution for this problem, can you share it? I would like to work on. Otherwise I will come with my solution and I will get advice from you guys. Thanks & Regards, -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html