Re: libnetfilter_conntrack's NFCT_OF_TIMESTAMP is not working

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Mar 15, 2016 at 12:04:35PM +0530, ravin goyal wrote:
> Hi
> 
> this email is in reference to previous email regarding the NFCT_OF_TIMESTAMP,
> 
> setting /proc/sys/net/netfilter/nf_conntrack_timestamp to 1 or 0
> doesn't run the following code in
> /libnetfilter_conntrack-1.0.4/src/conntrack/snprintf_default.c file
> 
>         if (flags & NFCT_OF_TIMESTAMP) {
>                 if (test_bit(ATTR_TIMESTAMP_START, ct->head.set)) {
>                         ret = __snprintf_timestamp_start(buf+offset, len, ct);
>                         BUFFER_SIZE(ret, size, len, offset);
>                 }
>                 if (test_bit(ATTR_TIMESTAMP_STOP, ct->head.set)) {
>                         ret = __snprintf_timestamp_stop(buf+offset, len, ct);
>                         BUFFER_SIZE(ret, size, len, offset);
>                 }
>         }
> 
> flags and NFCT_OF_TIMESTMP is always 1 and 8 respectively no matter value of
> /proc/sys/net/netfilter/nf_conntrack_timestamp is 1 or 0
> 
> So what value should i set of nf_conntrack_timestamp if i want to get
> start and stop timestamp from __snprintf_timestamp_start and
> __snprintf_timestamp_stop respectively.

# echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp

This is working fine here:

# conntrack -E -o ktimestamp
[DESTROY] udp      17 src=10.10.10.132 dst=8.8.8.8 sport=123 dport=123 src=8.8.8.8 dst=10.10.10.132 sport=123 dport=123 delta-time=30 [start=Tue Mar 15 11:15:59 2016] [stop=Tue Mar 15 11:16:29 2016]