Re: extending conntrack event data

[Pablo Neira <pablo@eurodev.net>]

Wang Jian wrote:
> On Thu, 21 Apr 2005 10:49:38 +0100, Amin Azez <azez@ufomechanic.net> wrote:
> 
> 
>>OK, I see that the skb is only available in ip_conntrack_event_cache and 
>>not ip_conntrack_event. I'm not clear on the different purposes of these 
>>two functions, but I see that both could potentially cause events in 
>>conntrack(-tool). I also see that notifier_call_chain is a general 
>>function and that my suggestion of adding an extra parameter to it is 
>>not likely to be well received.
> 
> 
> ip_conntrack_event_cache() marks a bitmap to indicate that certain event
> occurs. The message will not be delivered immediately due to whatever
> reason such as performance. 

right, performance is the reason why we use event caching. Spamming a 
netlink message to user space every time a packet is received is simply 
"matador" (overkill).

--
Pablo