add iptables 'helper' match manpage section (Herve Eychenne)

2 files changed, 12 insertions, 1 deletions

diff --git a/extensions/libipt_helper.c b/extensions/libipt_helper.c
index 8c59e2a6..4b16e021 100644
--- a/extensions/libipt_helper.c
+++ b/extensions/libipt_helper.c
@@ -14,7 +14,7 @@ help(void)
 {
 	printf(
 "helper match v%s options:\n"
-"[!] --helper value         Match helper value\n"
+"[!] --helper string        Match helper identified by string\n"
 "\n",
 IPTABLES_VERSION);
 }
diff --git a/iptables.8 b/iptables.8
index db9a691b..c1039fb0 100644
--- a/iptables.8
+++ b/iptables.8
@@ -445,6 +445,17 @@ into it's according numeric value.
 This module matches the SPIs in ESP header of IPSec packets.
 .TP
 .BR "--espspi " "[!] \fIspi\fP[:\fIspi\fP]"
+.SS helper
+This module matches packets related to a specific conntrack-helper.
+.TP
+.BI "--helper " "string"
+Matches packets related to the specified conntrack-helper.
+.TP
+string can be "ftp" for packets related to a ftp-session on default port.
+For other ports append -portnr to the value, ie. "ftp-2121".
+.br
+Same rules apply for other conntrack-helpers.
+.br
 .SS icmp
 This extension is loaded if `--protocol icmp' is specified.  It
 provides the following option: