From e3ec9362f0edad08834cb8ba66bc45fdb0bf33f5 Mon Sep 17 00:00:00 2001 From: Liping Zhang Date: Sun, 25 Dec 2016 20:12:55 +0800 Subject: ct: add average bytes per packet counter support Similar to connbytes extension in iptables, now you can use it to match average bytes per packet a connection has transferred so far. For example, match avgpkt in "BOTH" diretion: # nft add rule x y ct avgpkt \> 100 Match avgpkt in reply direction: # nft add rule x y ct reply avgpkt \< 900 Or match avgpkt in original direction: # nft add rule x y ct original avgpkt \> 200 Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso --- src/scanner.l | 1 + 1 file changed, 1 insertion(+) (limited to 'src/scanner.l') diff --git a/src/scanner.l b/src/scanner.l index 6b441b54..d0d25ea9 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -294,6 +294,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "name" { return NAME; } "packets" { return PACKETS; } "bytes" { return BYTES; } +"avgpkt" { return AVGPKT; } "counters" { return COUNTERS; } "quotas" { return QUOTAS; } -- cgit v1.2.3