Red Hat Enterprise Linux 5 Administration Unleashed

482CHAPTER 24Configuring a FirewallcommentAdd a comment to a rule.--comment Provide a comment of up to 256 characters.conditionMatch if the value of the specified /proc file is 0 or 1.--condition [!] Replace with the full path and filename of a file in the /proc directory.connbytesMatch according to the number of bytes or packets transferred or by the averagenumber of bytes per transfer.[!] --connbytes :Packets match if the number of packets, number of bytes, or average packet size is morethan but less than . The value for providing an upper limit is optional.--conbytes-dir Replace with original, reply, or both to match these types of packets.--connbytes-mode Replace with packets, bytes, or avgpkt to set what the lower and upperlimits from the --connbytes : command should be compared to.connlimitBlock a client by IP address or set a maximum number of TCP connections from a client.[!] --connlimit=above Maximum number of TCP connections. If the connection number exceeds the limit,the packets do not match the rule.--connlimit-mask Network mask of the network to restrict.connmarkMatch netfilter mark for the connection.--mark Match packets with specific mark value.connrateMatch current transfer rate for the connection.--connrate [!] :Match transfer rate greater than but less than .