Hi,
I would love to have this feature. Basically it would be same like "connection-bytes" right now, which mark based on the size of connection. Call it "connection-time" and it would mark first x seconds/minutes of connection.
Marking based on address list time-out is just not usable in so many cases.
Thank you.