I am trying to match packets by process name in iptabes. I was trying it with ping and an example I got from: https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#OWNERMATCH

The commands I entered were:

iptables -N mychain
iptables -A OUTPUT -m owner --cmd -owner ping -j mychain

However, I get:

iptables v1.4.21: unknown option "--cmd-owner"
Try 'iptables -h' or 'iptables --help' for more information.

When I do so, I can't see the "--cmd-owner" option. Is this because that option is no longer available in iptables v1.4.21? Can anyone tell me how I can math packets per process on my host if this option is no longer available?


Apparently it was dropped from iptables at some point... I can't figure out exactly when. I did find this Ubuntu bug report.


There is no reference to it being removed from git but there is a reference to when it was originally added.


Finally found it here: http://www.spinics.net/lists/netfilter/msg49716.html

commit 34b4a4a624bafe089107966a6c56d2a1aca026d4
Author: Christoph Hellwig <hch@xxxxxx>
Date:   Sun Aug 14 17:33:59 2005 -0700

    [NETFILTER]: Remove tasklist_lock abuse in ipt{,6}owner

    Rip out cmd/sid/pid matching since its unfixable broken and stands in the
    way of locking changes to tasklist_lock.

    Signed-off-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>

It's a little late to come with "I need this" 5 years after the fact.

>Is there any alternative for this? I mean to set up a static rule that
>assigns specific command-line netfilter acls?

SELinux, SNET, or other LSMs.

I'm sorry if it doesn't sound that helpful. This is the best I can do. I'm not so great with iptables stuff.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.