I am trying to match packets by process name in iptabes. I was trying it with ping and an example I got from: https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#OWNERMATCH

The commands I entered were:

iptables -N mychain
iptables -A OUTPUT -m owner --cmd -owner ping -j mychain

However, I get:

iptables v1.4.21: unknown option "--cmd-owner"
Try 'iptables -h' or 'iptables --help' for more information.

When I do so, I can't see the "--cmd-owner" option. Is this because that option is no longer available in iptables v1.4.21? Can anyone tell me how I can math packets per process on my host if this option is no longer available?


1 Answer 1


Apparently it was dropped from iptables at some point... I can't figure out exactly when. I did find this Ubuntu bug report.


There is no reference to it being removed from git but there is a reference to when it was originally added.


Finally found it here: http://www.spinics.net/lists/netfilter/msg49716.html

commit 34b4a4a624bafe089107966a6c56d2a1aca026d4
Author: Christoph Hellwig <hch@xxxxxx>
Date:   Sun Aug 14 17:33:59 2005 -0700

    [NETFILTER]: Remove tasklist_lock abuse in ipt{,6}owner

    Rip out cmd/sid/pid matching since its unfixable broken and stands in the
    way of locking changes to tasklist_lock.

    Signed-off-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>

It's a little late to come with "I need this" 5 years after the fact.

>Is there any alternative for this? I mean to set up a static rule that
>assigns specific command-line netfilter acls?

SELinux, SNET, or other LSMs.

I'm sorry if it doesn't sound that helpful. This is the best I can do. I'm not so great with iptables stuff.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .