Questions on state

Questions on state

[Jeff Simmons]

Sorry to bother anyone, but I'm new to iptables, and I'm debugging a working 
production machine, so I can't really test things too much. :-(

Is a connection ONLY added to the state table when the first packet matches a 
rule that contains the --state NEW directive, or can it happen in some other 
way?

When --state INVALID is matched, is it done only on the source and destination 
addresses and ports, or is something else also involved?

Are NAT 'states' available for examination anywhere, like 
/proc/net/ip_conntrack?

Thanks for any assistance.

-- 
Jeff Simmons                                   jsimmons@goblin.punk.net
     Simmons Consulting - Network Engineering, Administration, Security

"You guys, I don't hear any noise. Are you sure you're doing it right?"
	-- My Life With The Thrill Kill Kult

Re: Questions on state

[Jason Opperisano]

On Sun, 2005-03-13 at 19:23, Jeff Simmons wrote:
> Sorry to bother anyone, but I'm new to iptables, and I'm debugging a working 
> production machine, so I can't really test things too much. :-(
> 
> Is a connection ONLY added to the state table when the first packet matches a 
> rule that contains the --state NEW directive, or can it happen in some other 
> way?

connections begin getting added to the conntrack table as soon as the
ip_conntrack module is loaded.

> When --state INVALID is matched, is it done only on the source and destination 
> addresses and ports, or is something else also involved?

if the tcp_window_tracking patch is applied--sequence and acknowledgment
numbers are also examined.

> Are NAT 'states' available for examination anywhere, like 
> /proc/net/ip_conntrack?

yes.

-j

--
"Mr. Simpson, why are you here?
 Don't say revenge! Don't say revenge!
 Revenge?
 That's it! I'm outta here!"
	--The Simpsons

Re: Questions on state

[Jeff Simmons]

On Sunday 13 March 2005 17:42, Jason Opperisano wrote:

> > Is a connection ONLY added to the state table when the first packet
> > matches a rule that contains the --state NEW directive, or can it happen
> > in some other way?
>
> connections begin getting added to the conntrack table as soon as the
> ip_conntrack module is loaded.

The ip_conntrack module adds ALL connections to the conntrack table? Even ones 
where the state isn't used by the filter table?

--
Jeff Simmons                                   jsimmons@goblin.punk.net
     Simmons Consulting - Network Engineering, Administration, Security

"You guys, I don't hear any noise. Are you sure you're doing it right?"
	-- My Life With The Thrill Kill Kult

Re: Questions on state

[Jason Opperisano]

On Sun, 2005-03-13 at 21:09, Jeff Simmons wrote:
> The ip_conntrack module adds ALL connections to the conntrack table? Even ones 
> where the state isn't used by the filter table?

yes.  unless you have compiled in support for the raw table and use the
NOTRACK target to disable  connection tracking for specific connections.

the "-m state --state X" match is just a match, not a directive to do
anything.

-j

--
"Call this an unfair generalization if you must, but old people are
 no good at everything."
	--The Simpsons