All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira <pablo@eurodev.net>
To: Paul Albert <palbert@rovingplanet.com>,
	Netfilter Development Mailinglist
	<netfilter-devel@lists.netfilter.org>
Subject: Re: connection tracking question
Date: Thu, 13 May 2004 00:21:15 +0200	[thread overview]
Message-ID: <40A2A35B.4010809@eurodev.net> (raw)
In-Reply-To: <6A94CF724B046C4FB3434D14A49A58BF1CB7D3@pluto.rovingplanet.com>

Hi Paul,

Paul Albert wrote:

> Specifically, I would like to know when the ESTABLISHED state is set 
> in the kernel.


mmm, i suppose that you are talking about a tcp connection, in that 
case, see file ip_conntrack_proto_tcp.c. If that's not enough, you can 
have a look at tcp-window-tracking patch available in pom-ng which add 
interesting comment to understand tcp tracking.

>   I realize that it is when iptables sees an ACK of a SYN packet, for 
> example, but if I have a firewall rule in the nat/PREROUTING chain 
> that checks to ensure that the connection is ESTABLISHED, will the ACK 
> packet cause the rule to be hit?  Does the connection tracking take 
> place before the mangle/PREROUTING chain?


yes, connection tracking is the first hook in prerouting/output, so it's 
done before mangle. It's also the last in postrouting/input.
 
regards,
Pablo

  reply	other threads:[~2004-05-12 22:21 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-05-12 21:20 connection tracking question Paul Albert
2004-05-12 22:21 ` Pablo Neira [this message]
2004-05-12 22:35   ` Pablo Neira
2004-05-12 23:00 ` Henrik Nordstrom

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=40A2A35B.4010809@eurodev.net \
    --to=pablo@eurodev.net \
    --cc=netfilter-devel@lists.netfilter.org \
    --cc=palbert@rovingplanet.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.