The connrate match is used to match against the current transfer speed of a
connection. The algorithm averages transferred bytes over a time sliding window
of constant size. The maximum and minimum rates measurable are explained in the
code, along the algorithm used in the measurements.

This match can easily be used to reclassify connections based on their current
transfer rate, but is not meant for directly dropping packets, because packet
drops affect the rate being estimated.

The transfer rate per connection can also be viewed through
/proc/net/ip_conntrack.

Usage:
--connrate [!] [FROM]:[TO]

will match packet from a connection which is currently transferring more than
FROM bytes per second and less than TO byte per second. 'inf' can be used to
signify largest measurable transfer rate. If FROM is omitted, it defaults to
zero. If TO is omitted, it defaults to infinity. "!" is used to match packets
not falling in the range.

Example:

iptables .. -m connrate --connrate 10000:100000 ...

 => match packets in connections transferring faster than 10kbps, but slower
    than 100kbps.

iptables .. -m tos --tos Minimize-Delay \
            -m connrate --connrate 20000:inf \
            -j TOS --set-tos Maximize-Throughput

 => match packets in minimize-delay TOS connections that are transferring
    faster than 20kbps and change their tos to maximize-throughput instead.
