Re: ICMP conntrack

[Cedric Blancher <blancher@cartel-securite.fr>]

Le ven 18/10/2002 à 10:28, Antony Stone a écrit :
> > I was wondering why I'm not getting any conntrack entires for icmp
> > connections?
> There is no concept of a "connection" for ICMP.

Yes it's true, but for some, you have a request/reply concept.
 
> A single ICMP packet is sent to indicate some situation has occurred.   
> There's no reply, there's no follow-up packet, therefore there's no need to 
> keeptrack of a "connection" for something which consists of only a single 
> packet.

Two cases :

	request/reply : echo, timestamp, address mask and info
		First packet (request) is NEW, others (replies) are
		ESTABLISHED ; entries have a 30s timeout.
		If a unsolicitated reply is received, then INVALID.

	ICMP erros : ICMP payload is a quotation extracted from the IP
		packet that has generated the error. This quotation is
		used to identify the related session in conntrack table.
		If ICMP match an active entry, then it's RELATED. If
		not, it's INVALID.

So, for ICMP requests, you have some kind of conntrack, based on ICMP
sequence number. For ICMP errors, conntrack tries to associate them to
an existing entry.


-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE