Re: [PATCH 6/10][CTNETLINK] dump counters iif connection ended or counters filled up

[Amin Azez <azez@ufomechanic.net>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> This patch makes ctnetlink to dump counters iif connection reaches the
>> destroy state or altenatively if counters filled up.
>>
>> AFAICS counters on NEW and UPDATE events doesn't provide interesting
>> information, they just consume the limited netlink bandwidth.
>>
>> Upcoming conntrackd release in statistics mode uses counters from
>> DESTROY events to keep the contability of traffic that the firewall has
>> processed.
>>
>> I think that this patch should also reset counters upon fill up event,
>> comments?
> 
> Not sure, do you know any users of the counters besides conntrackd?
> I would like to look at how they're used.

I have a client daemon that reads the output of conntrackd, I would
prefer overflow rather than zero-ing. A main advantage is that "missing"
and event (netlink packet dropped) would not loose any information as
the overflow is visible by the fact that the counters are less than the
previous logged value and presuming they didn't overflow twice, its
obvious how much data passed in the mean time.

We could effectively increase the counter size by making the
counter-filled mask be the top few bits instead of just the top bit.
Then to actually wrap sooner (nearest thing to resetting that I like) we
just clear these top few bits.

Sam