/proc/net/ip_conntrack

/proc/net/ip_conntrack

[Martin Zdila]

Hello

We have local network with about 2000 users and all of them are going to
the Internet through main gateway using masquerade. The problem is IRC
and oident. It uses file /proc/net/ip_conntrack for searching the IP
address using known source and destination port numbers. But the oident
takes for it all CPU time, because file /proc/net/ip_conntrack grows and
changes very quickly. When I type cat /proc/net/ip_conntrack, the screen
scrolls with huge amount of conntrack lines forever.
Is there a another way how to find IP address belonged to known port
number? For example using kernel functions like ip_conntrack_get or
something similar?

Please HELP!
Thanks a lot!

Martin Zdila
zdila@antik.sk

/proc/net/ip_conntrack

[Daniel Corrêa de Azevedo]

   Hi.
   I wonder if any one could help me with figuring out a way to write to the 
proc file "/proc/net/ip_conntrack". What I need is to replicate this file 
from one computer to another. I already have all the content from the 
original file at the destination machine (easy part). What I need to do is 
figure a way to put its content into this destination 
machine /proc/net/ip_conntract file.
   Any one could give a clue where to find how to do this?
   Thanks,

                   Daniel C. Azevedo

Re: /proc/net/ip_conntrack

[Henrik Nordstrom]

On Tue, 29 Jun 2004, Daniel Corrêa de Azevedo wrote:

> I wonder if any one could help me with figuring out a way to write to the 
> proc file "/proc/net/ip_conntrack".

You can't. It is not a file, it is a window into the connection tracking 
function of the kernel showing you what is going on "right now". This 
window is bulletproof and you cant take things out or put things in via 
this window, only look at how they look.

> What I need is to replicate this file 
> from one computer to another.

See discussions on conntrack replication/syncronisation. There is an 
ongoing (not yet finished) project implementing this kind of function. 
There is a whole lot more involved than just "copying".

Regards
Henrik

Re: /proc/net/ip_conntrack

[Pablo Neira]

Hi Daniel,

Daniel Corrêa de Azevedo wrote:

>  I've just figured that out spending the hole night studing ip_conntrack source.
>

oh, welcome to the club. :-)

> Since I'm 
>really starting with advanced programming, it took me some time to figured out that 
>ip_conntrack matching works as a LKM (Loable Kernel Module) and that to write to the 
>/proc/net/ip_conntrack file, it should be a LKM too.
>  Tough, I still wonder if is there a solution to this problem.
>

sure, there is :-).

> I was thinking of LKMs and 
>wondering if it is possible to one write a LKM that interacts with the ip_conntrack LKM to 
>write entries to /proc/net/ip_conntrack? Or even write directly to it? 
>  
>

that's a misconception, you can't write to /proc/net/ip_conntrack. As 
Henrik pointed out, /proc/net/ip_conntrack is just an interface to give 
you a snapshot of the current state of the conntrack table. As this 
often get people confused, actually the replication of the conntrack is 
a problem a bit more complex than writing /proc/net/ip_conntrack.

Surely you can write a LKM which interacts with the ip_conntrack module, 
but you'll also need to export some symbols to do.

>   I've just loaded ip_conntrack LKM indirectly by inserting a statefull rule to iptables and 
>checkout what symbols it makes available.
>

check ip_conntrack_standalone.c to see exported symbols by the conntrack 
system.

>   Any way, what do you think about this? Does it sound like nonsense (I've just my first 
>contact with LKM...) or it maybe possible? 
>  
>

you should forget your thoughts about the /proc interface and start 
understanding some ip_conntrack internal to replicate the information to 
some backup's machines.

regards,
Pablo

Re: /proc/net/ip_conntrack

[Daniel Corrêa de Azevedo]

   Hi Henrik. 
 
> > I wonder if any one could help me with figuring out a way to write to the  
> > proc file "/proc/net/ip_conntrack". 
>  
> You can't. It is not a file, it is a window into the connection  
> tracking function of the kernel showing you what is going on "right  
> now". This window is bulletproof and you cant take things out or put  
> things in via this window, only look at how they look. 
 
  I've just figured that out spending the hole night studing ip_conntrack source. Since I'm 
really starting with advanced programming, it took me some time to figured out that 
ip_conntrack matching works as a LKM (Loable Kernel Module) and that to write to the 
/proc/net/ip_conntrack file, it should be a LKM too. 
  Tough, I still wonder if is there a solution to this problem. I was thinking of LKMs and 
wondering if it is possible to one write a LKM that interacts with the ip_conntrack LKM to 
write entries to /proc/net/ip_conntrack? Or even write directly to it? 
   I've just loaded ip_conntrack LKM indirectly by inserting a statefull rule to iptables and 
checkout what symbols it makes available. There are a few that, by their names, looks like 
inserts entries to ip_conntrack file (just guessing), like: 
 
d0901c50  GPLONLY_ip_conntrack_put_Re9c6735e  [ip_conntrack] 
 
   Any way, what do you think about this? Does it sound like nonsense (I've just my first 
contact with LKM...) or it maybe possible? 
 
>  
> > What I need is to replicate this file  
> > from one computer to another. 
>  
> See discussions on conntrack replication/syncronisation. There is an  
> ongoing (not yet finished) project implementing this kind of  
> function. There is a whole lot more involved than just "copying". 
 
   I'll look into google for "conntrack replication/syncronisation" and see what I can figure out, 
and also be waiting to see what you think about this considerations. 
   Thank's for your help, 
 
                        Daniel C. Azevedo 

Re: /proc/net/ip_conntrack

[Henrik Nordstrom]

On Wed, 30 Jun 2004, Pablo Neira wrote:

> >   Any way, what do you think about this? Does it sound like nonsense (I've just my first 
> >contact with LKM...) or it maybe possible? 
> 
> you should forget your thoughts about the /proc interface and start 
> understanding some ip_conntrack internal to replicate the information to 
> some backup's machines.

Or even better yet look into the already ongoing project implementing such 
interface to conntrack.

Regards
Henrik