Re: Owner on Input table

[Patrick Schaaf <bof@bof.de>]

>     This module attempts to match various
>     characteristics of the packet creator, 
>     for locally-generated packets. It is 
>     only valid in the OUTPUT chain, and even
>     this some packets (such as ICMP ping responses)
>     may have no owner, and hence never match. 
> 
> Are there any plans to change this policy?  If not, is this a limitation
> of the software or of the OS?  Is it not possible to use the destination
> ports process id to determine the owner?

It may be possible - after all, the kernel will do it some milliseconds
later - but would you really want your packet processing halted until
it is decided WHICH userlevel apache process will finally accept()
this incoming SYN packet?

In other words: it is neither easy, nor the right place, nor a unique
decision. Thus the policy of "better don't even try".

best regards
  Patrick