[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Problem with Netfilter (Packet Marking) and ip util



Title: RE: Problem with Netfilter (Packet Marking) and ip util

> -----Original Message-----
> From: jamal [mailto:hadi@cyberus.ca]
> > > Turn on netfilter debugging.
> >
> > Just did that, and I see nothing via dmesg or the messages
> file.  The
> > iptables manpage didn't contain a reference to 'debug'. 
> What else do I need
> > to do to see output from netfilter debugging?
> >
>
> Netfilter debugging prints a lot of crap, there is no wat you can
> miss that noise. Turn it on via compile options.

Well, I guess I'm missing the noise because I don't see it anywhere.  Do I need to make a change to any other config file (syslogd.conf perhaps?) to see the output?

Rusty gave me a hint this am.  He mentioned that iproute2 is interpreting the fwmark as hex.  I played with it a bit and found that the following works for a packet marked with 10 via iptables:

ip rule add fwmark 0xa table 201

or even

ip rule add fwmark a table 201  (minux the 0x hex designator)

where I replaced 10 with 0xa.  iproute2 is interpreting the number on it's command line as hex, not the mark itself.

Cheers!
Jon