Hi, Oskar Andreasson's Iptables Tutorial 1.1.9 lead me to believe that MARK is capable of doing what I want, but does not give enough details. On further reading I decided maybe not. What I to do is MARK a packet's stream. I want to be able to match ESTABLISHED packets to determine if they belong to a MARKed stream. Is this possible? Thanks,