1Like MARK, i.e. set the fwmark, but the mark is calculated from hashing
2packet selector at choice. You have also to specify the mark range and,
3optionally, the offset to start from. ICMP error messages are inspected
4and used to calculate the hashing.
5.PP
6Existing options are:
7.TP
8\fB\-\-hmark\-tuple\fP tuple\fI\fP
9Possible tuple members are:
10.B src
11meaning source address (IPv4, IPv6 address),
12.B dst
13meaning destination address (IPv4, IPv6 address),
14.B sport
15meaning source port (TCP, UDP, UDPlite, SCTP, DCCP),
16.B dport
17meaning destination port (TCP, UDP, UDPlite, SCTP, DCCP),
18.B spi
19meaning Security Parameter Index (AH, ESP), and
20.B ct
21meaning the usage of the conntrack tuple instead of the packet selectors.
22.TP
23\fB\-\-hmark\-mod\fP \fIvalue (must be > 0)\fP
24Modulus for hash calculation (to limit the range of possible marks)
25.TP
26\fB\-\-hmark\-offset\fP \fIvalue\fP
27Offset to start marks from.
28.TP
29For advanced usage, instead of using \-\-hmark\-tuple, you can specify custom
30prefixes and masks:
31.TP
32\fB\-\-hmark\-src\-prefix\fP \fIcidr\fP
33The source address mask in CIDR notation.
34.TP
35\fB\-\-hmark\-dst\-prefix\fP \fIcidr\fP
36The destination address mask in CIDR notation.
37.TP
38\fB\-\-hmark\-sport\-mask\fP \fIvalue\fP
39A 16 bit source port mask in hexadecimal.
40.TP
41\fB\-\-hmark\-dport\-mask\fP \fIvalue\fP
42A 16 bit destination port mask in hexadecimal.
43.TP
44\fB\-\-hmark\-spi\-mask\fP \fIvalue\fP
45A 32 bit field with spi mask.
46.TP
47\fB\-\-hmark\-proto\-mask\fP \fIvalue\fP
48An 8 bit field with layer 4 protocol number.
49.TP
50\fB\-\-hmark\-rnd\fP \fIvalue\fP
51A 32 bit random custom value to feed hash calculation.
52.PP
53\fIExamples:\fP
54.PP
55iptables \-t mangle \-A PREROUTING \-m conntrack \-\-ctstate NEW
56 \-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000
57\-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe
58.PP
59iptables \-t mangle \-A PREROUTING -j HMARK \-\-hmark\-offset 10000
60\-\-hmark-tuple src,dst,proto \-\-hmark-mod 10 \-\-hmark\-rnd 0xdeafbeef
61