Re: libnetfilter_conntrack's NFCT_OF_TIMESTAMP is not working

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Mar 15, 2016 at 04:21:38PM +0530, ravin goyal wrote:
> Hi
> 
> Thanks for the reply, I ran same command conntrack -E -o ktimestamp
> and results are same as you have shown
> but when i ran conntrack -E -otimestamp OR conntrack -E
> -otimestamp,extended , start and stop timestamp are missing in the
> output.

-o timestamp displays the timestamp at the beginning of the line:

[1458039983.184296]      [UPDATE] udp      17 180 src=10.10.10.132 dst=8.8.8.8 sport=36310 dport=53 ...
[1458040055.867546]     [DESTROY] udp      17 ... delta-time=180

and the delta-time when the entry is destroyed.

> Can you please explain how -o ktimestamp and -otimestamp,extended
> differ in output ??

-o ktimestamp relies on the in-kernel timestamp when you search for
   more precision.
-o timestamp is a userspace timestamp.

The 'extended' options, from manpage says:

        conntrack -L -o extended
        Show the connection tracking table in /proc/net/nf_conntrack format

This basically appends the layer 3 protocol at the beginning of the
line.

Please, send me patches to update conntrack(8) manpage if you believe
this information is not available there. Thanks.