When conntrack is active, the iptables stack never sees a fragmented IP packet, only the reassembled one (source), so the -f test never matches. If I want to block any fragment I could set ...
I would like to detect TCP connections which have been open for more than one minute (or for greater than N bytes, or M packets), so I can classify them as bulk traffic ("downloads") and de-prioritise ...
I want each packet (that match iptables rule) to be delayed by some fixed time interval. How to to this? Preudocode: iptables -A INPUT -p udp <more conditions> -j DELAY --delay 50000 # delay ...