Re: [PATCH 6/10][CTNETLINK] dump counters iif connection ended or counters filled up

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
> 
>>This patch makes ctnetlink to dump counters iif connection reaches the
>>destroy state or altenatively if counters filled up.
>>
>>AFAICS counters on NEW and UPDATE events doesn't provide interesting
>>information, they just consume the limited netlink bandwidth.
>>
>>Upcoming conntrackd release in statistics mode uses counters from
>>DESTROY events to keep the contability of traffic that the firewall has
>>processed.
>>
>>I think that this patch should also reset counters upon fill up event,
>>comments?
> 
> Not sure, do you know any users of the counters besides conntrackd?

I don't know any ctnetlink user of the counters. Thinking it well this 
"counters fill up" issue is tricky. Since netlink is unreliable, what if 
the fill up event gets lost? we could reset counters and nobody would 
apparently notice. I think that we need an overflow bit in the conntrack 
that must be set whenever and overflow happens and unset such bit once 
the overflow event has been caught.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris