Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

in the below example iptables -A FORWARD -i eth0 -p tcp --syn -m mark --mark 0x3 -j REJECT --reject-with tcp-reset

what is the significance of -m mark --mark field.

When i am trying to add this rule i am getting following error.

iptables: Protocol wrong type for socket ?


share|improve this question

migrated from Sep 10 '12 at 4:47

This question came from our site for professional and enthusiast programmers.

I have upgraded my kernel from version 2.6.24 to version 2.6.32, but my iptables was not upgraded they stays at 1.3.6. If I wanted to use MARK the error message "iptables: Protocol wrong type for socket" appeared. After upgrading iptables to version 1.4.8 everything works.

share|improve this answer

Mark match is used by netfilter to match packets that were marked in the mangle table.Not knowing the specifics I would guess either your kernel is very out of date/you kernel compile errors or your netfilter package might need a look at.

-iptables man page -

mark This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below).

   [!] --mark value[/mask]
          Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mask before the comparison).
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.