Some questions about “-set-xmark” in iptables
Clash Royale CLAN TAG #URR8PPP Some questions about “-set-xmark” in iptables I have a rule as following: -A PREROUTING -d 10.228.20.15/32 -p tcp -m tcp --dport 80--tcp-flags FIN,SYN,RST,ACK SYN -j MARK --set-xmark 0x70/0xffffffff The man doc explains --set-xmark as below: --set-xmark Zero out the bits given by mask and XOR value into the ctmark. English is not my native language. Could anyone help to explain what value would be set into ctmark? What zero out means? Take a example would be appreciated. 2 Answers 2 So the syntax is --set-xmark value/mask . The resulting operation is: --set-xmark value/mask ctmark = (ctmark AND NOT mask) XOR value Zero-out corresponds to (ctmark AND NOT mask) : if a bit in mask is set, then the corresponding bit in ctmark will be zero (before the XOR). (ctmark AND NOT mask) mask ctmark The man page also states: --and-mark bits Binary AND the ctmark with bits....