For tcp/53 + udp/53: TCP and UDP have the port at the same offset. You could use a 'u32' (or 'string') match using the offset of the port field. (The source port is the 16 bits just after the IP header; the destination port is the next 32 bits.) You'd also have to match the two protocols numerically. Just sayin'. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html