Manpage of IPTABLES
ANDed with the mask before the comparison).
owner
This module attempts to match various characteristics of the packet creator, for locally-generated packets.
It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.
--uid-owner userid
Matches if the packet was created by a process with the given effective user id.
--gid-owner groupid
Matches if the packet was created by a process with the given effective group id.
--pid-owner processid
Matches if the packet was created by a process with the given process id.
--sid-owner sessionid
Matches if the packet was created by a process in the given session group.
--cmd-owner name
Matches if the packet was created by a process with the given command name. (this option is
present only if iptables was compiled under a kernel supporting this feature)
state
This module, when combined with connection tracking, allows access to the connection tracking state for
this packet.
--state state
Where state is a comma separated list of the connection states to match. Possible states are
INVALID meaning that the packet is associated with no known connection, ESTABLISHED
meaning that the packet is associated with a connection which has seen packets in both directions,
NEW meaning that the packet has started a new connection, or otherwise associated with a
connection which has not seen packets in both directions, and RELATED meaning that the packet
is starting a new connection, but is associated with an existing connection, such as an FTP data
transfer, or an ICMP error.
conntrack
http://www.iptablesrocks.org/syntax/man_iptables.htm (9 of 20) [2/13/2004 8:04:51 PM]
