Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 1 | Match by how many bytes or packets a connection (or one of the two |
Jan Engelhardt | 6cf172e | 2008-03-10 17:48:59 +0100 | [diff] [blame] | 2 | flows constituting the connection) has transferred so far, or by |
Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 3 | average bytes per packet. |
| 4 | |
| 5 | The counters are 64bit and are thus not expected to overflow ;) |
| 6 | |
| 7 | The primary use is to detect long-lived downloads and mark them to be |
| 8 | scheduled using a lower priority band in traffic control. |
| 9 | |
Jan Engelhardt | 6cf172e | 2008-03-10 17:48:59 +0100 | [diff] [blame] | 10 | The transferred bytes per connection can also be viewed through |
Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 11 | /proc/net/ip_conntrack and accessed via ctnetlink |
| 12 | .TP |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 13 | [\fB!\fP] \fB\-\-connbytes\fP \fIfrom\fP[\fB:\fP\fIto\fP] |
Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 14 | match packets from a connection whose packets/bytes/average packet |
| 15 | size is more than FROM and less than TO bytes/packets. if TO is |
| 16 | omitted only FROM check is done. "!" is used to match packets not |
| 17 | falling in the range. |
| 18 | .TP |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 19 | \fB\-\-connbytes\-dir\fP {\fBoriginal\fP|\fBreply\fP|\fBboth\fP} |
Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 20 | which packets to consider |
| 21 | .TP |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 22 | \fB\-\-connbytes\-mode\fP {\fBpackets\fP|\fBbytes\fP|\fBavgpkt\fP} |
Jonas Berlin | f33c461 | 2005-04-01 06:54:23 +0000 | [diff] [blame] | 23 | whether to check the amount of packets, number of bytes transferred or |
| 24 | the average size (in bytes) of all packets received so far. Note that |
| 25 | when "both" is used together with "avgpkt", and data is going (mainly) |
| 26 | only in one direction (for example HTTP), the average packet size will |
| 27 | be about half of the actual data packets. |
| 28 | .TP |
| 29 | Example: |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 30 | iptables .. \-m connbytes \-\-connbytes 10000:100000 \-\-connbytes\-dir both \-\-connbytes\-mode bytes ... |