Re: Reg iptables Connection tracking

[Athan <netfilter@miggy.org>]

[-- Attachment #1: Type: text/plain, Size: 2142 bytes --]

On Fri, Jan 10, 2003 at 04:04:54PM +0530, Amit Kumar Gupta wrote:
> On Friday 10 January 2003 12:37 am, you wrote:
> > Well I am able to see upto this point. I went through the code flow
> > also. But I don't know why it prints the message(Even if increasing
> > the value from 1016 to 4096 by hardcoding it in the kernel). Another
> > issue is I don't know how it is taking 1016. As There is no /proc file
> > system, and by default it shoud take 0.

   I missed this before, sorry.  Is this due to specifically disabling
/proc and/or specifically not mounting it for security reasons?  If not,
just enable it and mount it already.

> Not that this helps much.  The real problem is WHAT is the conntrack 
> table filling with.  And I suspect it may be nothing, that you have a 
> problem because it is trying to use /proc/net/conntrack and there IS no 
> /proc/net/conntrack.  The message may be triggering incorrectly, 
> presuming that since it cannot write another entry to 
> /proc/net/conntrack that the table is full.

   Er, no.  That's not what /proc/net/ip_conntrack is.  It doesn't EXIST
as such until you try to read from it.  All of /proc is virtual.  Just
because you have no /proc and can't get at 'files' in it doesn't mean
the SOURCE of their data doesn't exist.

> /proc in order to work.  If I think of something else I'll email you 
> again.  Sorry.

   I'd certainly recommend having /proc around as well.  There's the
sysctl() interface for querying/changing some values too.  Aha! You can
set net/ipv4/ip_conntrack_max from this too *8-):

	sysctl -w net/ipv4/ip_conntrack_max=32768

If your kernel doesn't have the sysctl support then, er, you're kind of
shooting yourself in the foot for tuning things at ALL, including things
like turning IP forwarding on and off, global TCP ECN support, SYN
cookies etc....

HTH,

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]