On Sun, Dec 25, 2016 at 08:27:51PM +0800, Liping Zhang wrote: > From: Liping Zhang <zlpnobody@xxxxxxxxx> > > For example: > # iptables-translate -A OUTPUT -m connbytes --connbytes 200 \ > --connbytes-dir original --connbytes-mode packets > nft add rule ip filter OUTPUT ct original packets ge 200 counter > > # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200 \ > --connbytes-dir reply --connbytes-mode packets > nft add rule ip filter OUTPUT ct reply packets lt 200 counter > > # iptables-translate -A OUTPUT -m connbytes --connbytes 200:600 \ > --connbytes-dir both --connbytes-mode bytes > nft add rule ip filter OUTPUT ct bytes 200-600 counter > > # iptables-translate -A OUTPUT -m connbytes ! --connbytes 200:600 \ > --connbytes-dir both --connbytes-mode bytes > nft add rule ip filter OUTPUT ct bytes != 200-600 counter > > # iptables-translate -A OUTPUT -m connbytes --connbytes 200:200 \ > --connbytes-dir both --connbytes-mode avgpkt > nft add rule ip filter OUTPUT ct avgpkt 200 counter Also applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
