At now I'm clueless, despite viewing the source of iptables v1.27a. When I invoke iptables -t mangle -A ecn_defunct -p tcp -d 216.104.161.48/29 -j ECN -m ecn --ecn-tcp-remove on the existing, empty chain ecn_defunct, an error message emerges: iptables v1.2.7a: ECN match: some option required Seems that any parameter is lacking, judging after the ipt_ECN.c source, but how to resolve this issue? The modules ipt_ecn and ipt_ECN are loaded due to lsmod, by the way. Kernel is 2.4.20 vanilla with xfs patch only applied. Registered Linux-User #169380 on http://counter.li.org/