Selecting fwmark with tcpdump?

Selecting fwmark with tcpdump?

Post by Steen Suder, priva » Fri, 06 Jun 2003 06:04:44

I have this Linux 2.4.20 box that does SNAT for the LAN.
To do some traffic control some packets are marked in the PREROUTING
chain in the mangle table:

$IPT -t mangle -A PREROUTING -i $DEV -m mac \
--mac-source 00:08:02:A3:84:B9 -j MARK --set-mark 99

What bothers me is that the counter in PREROUTING tends to grow faster
than the similar "-j ACCEPT"-rule in FORWARD.

I'd very much like to dump packets with tcpdump (or perhaps similar)
selecting on the fwmark so I can see what gets through and what does not.

How do I make tcpdump select on fwmark?

(RTFM, I do not find anything that looks like a solution in 'man
tcpdump', but then again I'm not a shark in this field.)

Mvh. / Best regards,
S* Suder             <;
ICQ UIN                 4133803