1Match by how many bytes or packets a connection (or one of the two 2flows constituting the connection) have tranferred so far, or by 3average bytes per packet. 4 5The counters are 64bit and are thus not expected to overflow ;) 6 7The primary use is to detect long-lived downloads and mark them to be 8scheduled using a lower priority band in traffic control. 9 10The transfered bytes per connection can also be viewed through 11/proc/net/ip_conntrack and accessed via ctnetlink 12.TP 13[\fB!\fR]\fB --connbytes \fIfrom\fB:\fR[\fIto\fR] 14match packets from a connection whose packets/bytes/average packet 15size is more than FROM and less than TO bytes/packets. if TO is 16omitted only FROM check is done. "!" is used to match packets not 17falling in the range. 18.TP 19\fB--connbytes-dir\fR [\fBoriginal\fR|\fBreply\fR|\fBboth\fR] 20which packets to consider 21.TP 22\fB--connbytes-mode\fR [\fBpackets\fR|\fBbytes\fR|\fBavgpkt\fR] 23whether to check the amount of packets, number of bytes transferred or 24the average size (in bytes) of all packets received so far. Note that 25when "both" is used together with "avgpkt", and data is going (mainly) 26only in one direction (for example HTTP), the average packet size will 27be about half of the actual data packets. 28.TP 29Example: 30iptables .. -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes ... 31