While adding iptables rules, I couldn't understand what is the difference between connmark and mark? If anyone explains it with detailed explanations, I will be appreciated.

1 Answer 1


MARK associates "marks" with packets. CONNMARK associates "marks" with connections. The second one is useful because you can mark all the packets of a connection or related to a connection with the same mark (for example, FTP). Another usefull use of CONNMARK is that you can mark packets using the criteria that only matches with the first packet.

  • 3
    Agreed. You almost always want to use CONNMARK, unless you know why you don't. If in doubt, use CONNMARK.
    – bahamat
    Jul 13, 2012 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .