Re: /proc/net/ip_conntrack filling without ipt_conntrack.o loaded?

[Filip Sneppe <filip.sneppe@cronos.be>]

On Tue, 2003-01-14 at 16:06, Christian Hammers wrote:
> 
> On Tue, Jan 14, 2003 at 02:43:45PM +0100, Filip Sneppe wrote: 
> > About the high nuber of tracked connections, are you
> > talking about /proc/net/ip_conntrack ?
> Yes. As wrote in my previous mail (should have written it here, too),

Ah - that mail - I already deleted it from my mailbox.

> this router does asymetric routing, i.e. the packets for a connection
> come in over it but the answer packets go out via another router. 
> So it will almost never see a real 3way tcp handshake or the like.
> 

Wel, connection tracking was not really designed to handle asymetric
routing setups, so you're basically screwed. No stateful
packet filtering firewall will handle this decently, I guess.

On thing you can do, is apply the 'raw' patch from patch-o-matic
(written by Jozsef Kadlecsik), this allows you not to track
particular traffic. In your case, you will need to specify
rules for all (asymetric) traffic that should not be tracked by 
your firewall. If *all* your traffic is essentially asymetric in
nature, you'de be better off not using ip_conntrack at all...

Hope this helps...

Regards,
Filip