Iptables / What is the difference between connmark and mark?
Solution 1:
MARK associates "marks" with packets. CONNMARK associates "marks" with connections. The second one is useful because you can mark all the packets of a connection or related to a connection with the same mark (for example, FTP). Another usefull use of CONNMARK is that you can mark packets using the criteria that only matches with the first packet.