Dear all, I have a question about the way netfilter matches the fields in a rule. for example in : iptables -A FORWARD -p tcp -m condition --condition myweb -m string --string 'test' -j DROP there are 3 fields: protocol:tcp, condition:myweb and string: 'test' . if these 3 fields are matched serially ( one bye one ), then we will not pay the cost of string matching for none-tcp packets, also if the "myweb" condition is off again we have not to concern the string matching overhead. But if they are matched in parallel, then we will pay the cost of string matching for all packets. Does any one no which method (serial or parallel) is really used by netfilter? regards afshin lamei
