You can also mangle packets to mark them for later disposition. Why? Well, you might want to mark incoming packets from a particular source so that you can apply a special set of rules to them later. One thing to remember is that once a match is made in any given chain, the chain terminates. This allows you to use a match mark to terminate a filter chain that would otherwise eliminate the packet if it were unmarked, or any of a number of other uses.