Lines Matching refs:a
64 Connection tracking keeps a record of what packets have passed
72 To compile it as a module, choose M here. If unsure, say N.
112 Normally, each connection needs to have a unique system wide
134 provide a notifier chain that can be used by other kernel code
215 To compile it as a module, choose M here. If unsure, say N.
227 To compile it as a module, choose M here. If unsure, say N.
234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
239 With this module you can support H.323 on a connection tracking/NAT
247 To compile it as a module, choose M here. If unsure, say N.
253 There is a commonly-used extension to IRC called
256 of a server. DCC Sending is used anywhere you send files over IRC,
262 To compile it as a module, choose M here. If unsure, say N.
284 To compile it as a module, choose M here. If unsure, say N.
299 To compile it as a module, choose M here. If unsure, say N.
309 If you are running PPTP sessions over a stateful firewall or NAT
315 in PNS->PAC direction. This is a violation of RFC2637.
316 - Only supports a single call within each session
318 To compile it as a module, choose M here. If unsure, say N.
324 SANE is a protocol for remote access to scanners as implemented
328 With this module you can support SANE on a connection tracking
331 To compile it as a module, choose M here. If unsure, say N.
340 the nf_nat_sip modules you can support the protocol on a connection
343 To compile it as a module, choose M here. If unsure, say N.
351 If you are using a tftp client behind -j SNAT or -j MASQUERADING
354 To compile it as a module, choose M here. If unsure, say N.
361 This option enables support for a netlink-based userspace interface
448 provides a pseudo-state machine with an extensible instruction-set
455 To compile it as a module, choose M here.
463 look up for elements in a set and to build one-way mappings between
472 This option enables support for a mixed IPv4/IPv6 "inet" table.
483 incremental counting and random numbers bound to a upper limit.
503 include packet and byte counters in a rule.
604 a hash operation on registers.
624 of a packets security association.
632 This option allows matching for the presence or absence of a
702 To compile it as a module, choose M here.
712 To compile it as a module, choose M here.
747 Netfilter allows you to store a mark value per connection (a.k.a.
761 To compile it as a module, choose M here. If unsure, say N.
772 This option adds a 'AUDIT' target, which can be used to create
775 To compileit as a module, choose M here. If unsure, say N.
782 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
789 when such packets are sent via a virtual network device.
791 To compile it as a module, choose M here. If unsure, say N.
797 This option adds a `CLASSIFY' target, which enables the user to set
798 the priority of a packet. Some qdiscs can use this value for
803 To compile it as a module, choose M here. If unsure, say N.
811 This is a backwards-compat option for the user's convenience
825 To compile it as a module, choose M here. If unsure, say N.
833 This options adds a `CT' target, which allows to specify initial
837 To compile it as a module, choose M here. If unsure, say N.
844 This option adds a `DSCP' target, which allows you to manipulate
853 To compile it as a module, choose M here. If unsure, say N.
878 which set the skbuff mark by means of hash calculation within a given
882 To compile it as a module, choose M here. If unsure, say N.
891 added. When the timer expires, it triggers a sysfs notification.
894 To compile it as a module, choose M here. If unsure, say N.
901 This option adds a `LED' target, which allows you to blink LEDs in
904 This can be used to turn a spare LED into a network activity LED,
906 you could have an LED which lights up for a minute or two every time
927 This option adds a `LOG' target, which allows you to create rules in
930 To compile it as a module, choose M here. If unsure, say N.
937 This is a backwards-compat option for the user's convenience
947 To compile it as a module, choose M here. If unsure, say N.
957 To compile it as a module, choose M here. If unsure, say N.
967 To compile it as a module, choose M here. If unsure, say N.
979 To compile it as a module, choose M here. If unsure, say N.
992 This option adds a `RATEEST' target, which allows to measure
996 To compile it as a module, choose M here. If unsure, say N.
1003 REDIRECT is a special case of NAT: all incoming connections are
1008 To compile it as a module, choose M here. If unsure, say N.
1016 Masquerading is a special case of NAT: all outgoing connections are
1017 changed to seem to come from a particular interface's address, and
1022 To compile it as a module, choose M here. If unsure, say N.
1033 This option adds a "TEE" target with which a packet can be cloned and
1048 This option adds a `TPROXY' target, which is somewhat similar to
1050 to redirect traffic to a transparent proxy. It does _not_ depend
1056 To compile it as a module, choose M here. If unsure, say N.
1067 If you want to compile it as a module, say M here and read
1078 To compile it as a module, choose M here. If unsure, say N.
1085 This option adds a `TCPMSS' target, which allows you to alter the
1099 Workaround: activate this option and add a rule to your firewall
1105 To compile it as a module, choose M here. If unsure, say N.
1112 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1126 If you want to compile it as a module, say M here and read
1133 BPF matching applies a linux socket filter to each packet and
1136 To compile it as a module, choose M here. If unsure, say N.
1154 network servers/stateful firewalls without having a dedicated
1168 This option adds a `comment' dummy-match, which allows you to put
1171 If you want to compile it as a module, say M here and read
1179 This option adds a `connbytes' match, which allows you to match the
1180 number of bytes and/or packets for each direction within a connection.
1182 If you want to compile it as a module, say M here and read
1192 to a connection. The kernel only stores bit values - mapping
1195 Unlike connmark, more than 32 flag bits may be assigned to a
1205 connections to a server per client IP address (or address block).
1213 This is a backwards-compat option for the user's convenience
1222 This is a general conntrack match module, a superset of the state match.
1228 To compile it as a module, choose M here. If unsure, say N.
1237 To compile it as a module, choose M here. If unsure, say N.
1248 If you want to compile it as a module, say M here and read
1255 This options adds a `devgroup' match, which allows to match on the
1256 device group a network device is assigned to.
1258 To compile it as a module, choose M here. If unsure, say N.
1264 This option adds a `DSCP' match, which allows you to match against
1269 It will also add a "tos" match, which allows you to match packets
1273 To compile it as a module, choose M here. If unsure, say N.
1282 To compile it as a module, choose M here. If unsure, say N.
1288 This match extension allows you to match a range of SPIs
1291 To compile it as a module, choose M here. If unsure, say N.
1298 This option adds a `hashlimit' match.
1300 As opposed to `limit', this match dynamically creates a hash table
1306 with a single rule.
1314 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1316 To compile it as a module, choose M here. If unsure, say Y.
1330 This match extension allows you to match a range of CPIs(16 bits)
1333 To compile it as a module, choose M here. If unsure, say N.
1339 This option adds a "iprange" match, which allows you to match based on
1351 This option allows you to match against IPVS properties of a packet.
1363 To compile it as a module, choose M here. If unsure, say N.
1369 This option allows you to match the length of a packet against a
1372 To compile it as a module, choose M here. If unsure, say N.
1378 limit matching allows you to control the rate at which a rule can be
1382 To compile it as a module, choose M here. If unsure, say N.
1391 To compile it as a module, choose M here. If unsure, say N.
1398 This is a backwards-compat option for the user's convenience
1407 a series of source or destination ports: normally a rule can only
1408 match a single range of ports.
1410 To compile it as a module, choose M here. If unsure, say N.
1420 To compile it as a module, choose M here. If unsure, say N.
1434 To compile it as a module, choose M here. If unsure, say N.
1442 possible to check whether a socket actually exists.
1453 To compile it as a module, choose M here. If unsure, say N.
1463 To compile it as a module, choose M here. If unsure, say N.
1469 Packet type matching allows you to match a packet by
1475 To compile it as a module, choose M here. If unsure, say N.
1481 This option adds a `quota' match, which allows to match on a
1484 If you want to compile it as a module, say M here and read
1491 This option adds a `quota2' match, which allows to match on a
1496 If you want to compile it as a module, say M here and read
1504 This option allows `quota2' to log ONCE when a quota limit
1515 This option adds a `rateest' match, which allows to match on the
1518 To compile it as a module, choose M here. If unsure, say N.
1525 This option adds a `realm' match, which allows you to use the realm
1531 If you want to compile it as a module, say M here and read
1553 If you want to compile it as a module, say M here and read
1567 This option adds a `socket' match, which can be used to match
1568 packets for which a TCP or UDP socket lookup finds a valid socket.
1572 To compile it as a module, choose M here. If unsure, say N.
1580 relationship to a tracked connection (ie. previous packets). This
1581 is a powerful tool for packet classification.
1583 To compile it as a module, choose M here. If unsure, say N.
1589 This option adds a `statistic' match, which allows you to match
1590 on packets periodically or randomly with a given percentage.
1592 To compile it as a module, choose M here. If unsure, say N.
1602 This option adds a `string' match, which allows you to look for
1605 To compile it as a module, choose M here. If unsure, say N.
1611 This option adds a `tcpmss' match, which allows you to examine the
1615 To compile it as a module, choose M here. If unsure, say N.
1621 This option adds a "time" match, which allows you to match based on
1628 If you want to compile it as a module, say M here.
1635 u32 allows you to extract quantities of up to 4 bytes from a packet,
1637 test whether the results are in any of a set of specified ranges.