| Match by how many bytes or packets a connection (or one of the two |
| flows constituting the connection) have tranferred so far, or by |
| average bytes per packet. |
| |
| The counters are 64bit and are thus not expected to overflow ;) |
| |
| The primary use is to detect long-lived downloads and mark them to be |
| scheduled using a lower priority band in traffic control. |
| |
| The transfered bytes per connection can also be viewed through |
| /proc/net/ip_conntrack and accessed via ctnetlink |
| .TP |
| [\fB!\fR]\fB --connbytes \fIfrom\fB:\fR[\fIto\fR] |
| match packets from a connection whose packets/bytes/average packet |
| size is more than FROM and less than TO bytes/packets. if TO is |
| omitted only FROM check is done. "!" is used to match packets not |
| falling in the range. |
| .TP |
| \fB--connbytes-dir\fR [\fBoriginal\fR|\fBreply\fR|\fBboth\fR] |
| which packets to consider |
| .TP |
| \fB--connbytes-mode\fR [\fBpackets\fR|\fBbytes\fR|\fBavgpkt\fR] |
| whether to check the amount of packets, number of bytes transferred or |
| the average size (in bytes) of all packets received so far. Note that |
| when "both" is used together with "avgpkt", and data is going (mainly) |
| only in one direction (for example HTTP), the average packet size will |
| be about half of the actual data packets. |
| .TP |
| Example: |
| iptables .. -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes ... |