I am little confused with Netfilter marks and iptables CONNMARK. Please help clear the understanding.

example:
iptables -t mangle -A mychain -j CONNMARK --restore-mark --mask 0xff
iptables -t mangle -A mychain -m connmark !--mark 0/0xff00 -j RETURN

The first one is CONNMARK target is trying to restore the "mark" made by what? Is it connection tracking? But markings are not done at ip_conntrack is it? packet marking is done at the iptables - right? I am confused

Also, the second one in the rule, it is trying to match a mark if it is non-zero and if there is a match it returns? Please help untangle my misunderstanding.

May be that http://www.frozentux.net/documents/iptables-tutorial/, helps you.

Not really. Doesn't explain what I want.

I don't know but, if you prefer I show you:

Option: --restore-mark
Explanation: This target option restores the packet mark from the connection mark as defined by the CONNMARK.

English is not my native language, but I understood.

You didn't read/understand properly what I am asking. I am asking what is this "mark" it is trying to restore? Where is this mark come from? What process puts the mark on the packet? What is the basis of this mark?

No one knows the answer? Strange!

Post your entire script so we can take a look at it.