1 Match by how many bytes or packets a connection (or one of the two 2 flows constituting the connection) have tranferred so far, or by 3 average bytes per packet. 4 5 The counters are 64bit and are thus not expected to overflow ;) 6 7 The primary use is to detect long-lived downloads and mark them to be 8 scheduled using a lower priority band in traffic control. 9 10 The transfered bytes per connection can also be viewed through 11 /proc/net/ip_conntrack and accessed via ctnetlink 12 .TP 13 [\fB!\fR]\fB --connbytes \fIfrom\fB:\fR[\fIto\fR] 14 match packets from a connection whose packets/bytes/average packet 15 size is more than FROM and less than TO bytes/packets. if TO is 16 omitted only FROM check is done. "!" is used to match packets not 17 falling in the range. 18 .TP 19 \fB--connbytes-dir\fR [\fBoriginal\fR|\fBreply\fR|\fBboth\fR] 20 which packets to consider 21 .TP 22 \fB--connbytes-mode\fR [\fBpackets\fR|\fBbytes\fR|\fBavgpkt\fR] 23 whether to check the amount of packets, number of bytes transferred or 24 the average size (in bytes) of all packets received so far. Note that 25 when "both" is used together with "avgpkt", and data is going (mainly) 26 only in one direction (for example HTTP), the average packet size will 27 be about half of the actual data packets. 28 .TP 29 Example: 30 iptables .. -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes ... 31
