All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira <pablo@eurodev.net>
To: Thomas <toom@docisland.org>
Cc: netfilter-devel@lists.netfilter.org
Subject: Re: ctnetlink weird events on ipsec connections
Date: Sun, 08 May 2005 13:49:14 +0200	[thread overview]
Message-ID: <427DFCBA.5090702@eurodev.net> (raw)
In-Reply-To: <1115048084.12112.52.camel@localhost.localdomain>

Hi,

Thomas wrote:
> Hello,
> 
> I recently tried the new ip_conntrack_netlink feature and I got a weird
> result with ipsec connections : 
> # conntrack -E conntrack
> [DESTROY] src=<VPNGW_1> dst=<VPNGW_2>
>           src=<VPNGW_2> dst=<VPNGW_1> timeout:180
>           orig_packets=8391 orig_bytes=1252012,
>           reply_packets=19 reply_bytes=11424 
> [DESTROY] src=<INTERNAL_IP1> dst=<INTERNAL_IP2>
>           src=<INTERNAL_IP2> dst=<INTERNAL_IP1> timeout:432000
>           orig_packets=7763 orig_bytes=572775,
>           reply_packets=5219 reply_bytes=1209729 
> [DESTROY] src=<VPNGW_1> dst=<VPNGW_2>
>           src=<VPNGW_2> dst=<VPNGW_1> timeout:180
>           orig_packets=8392 orig_bytes=1252140,
>           reply_packets=19 reply_bytes=11424 
> [

DESTROY] src=<INTERNAL_IP1> dst=<INTERNAL_IP2>
>           src=<INTERNAL_IP2> dst=<INTERNAL_IP1> timeout:432000
>           orig_packets=7764 orig_bytes=572827,
>           reply_packets=5221 reply_bytes=1210553 
> and so on ...
> 
> both INTERNAL_IP2 and VPNGW_2 ip are in the same host where I run
> conntrack tool.

I recently posted a patch to delete the use of nfcache in ip_tables, 
this causes some interferences to the conntrack-event-api. I think that 
it could be related to your problem.

https://lists.netfilter.org/pipermail/netfilter-devel/2005-May/019574.html

Could you give it a try and let me know if it fixes your problem?

--
Pablo

  reply	other threads:[~2005-05-08 11:49 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-05-02 15:34 ctnetlink weird events on ipsec connections Thomas
2005-05-08 11:49 ` Pablo Neira [this message]
  -- strict thread matches above, loose matches on Subject: below --
2005-05-10 13:52 Thomas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=427DFCBA.5090702@eurodev.net \
    --to=pablo@eurodev.net \
    --cc=netfilter-devel@lists.netfilter.org \
    --cc=toom@docisland.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.