Re: [PATCH 6/10][CTNETLINK] dump counters iif connection ended or counters filled up

[Amin Azez <azez@ufomechanic.net>]

Pablo Neira Ayuso wrote:
> Patrick McHardy wrote:
>> Pablo Neira Ayuso wrote:
>>
>>> This patch makes ctnetlink to dump counters iif connection reaches the
>>> destroy state or altenatively if counters filled up.
>>>
>>> AFAICS counters on NEW and UPDATE events doesn't provide interesting
>>> information, they just consume the limited netlink bandwidth.
>>>
>>> Upcoming conntrackd release in statistics mode uses counters from
>>> DESTROY events to keep the contability of traffic that the firewall has
>>> processed.
>>>
>>> I think that this patch should also reset counters upon fill up event,
>>> comments?
>>
>> Not sure, do you know any users of the counters besides conntrackd?
> 
> I don't know any ctnetlink user of the counters. Thinking it well this
> "counters fill up" issue is tricky. Since netlink is unreliable, what if
> the fill up event gets lost? we could reset counters and nobody would
> apparently notice. I think that we need an overflow bit in the conntrack
> that must be set whenever and overflow happens and unset such bit once
> the overflow event has been caught.
> 

What does it mean to "catch" the overflow even, esp as there may be
multiple clients each catching it (or not) for themselves.

A straight overflow is more simple. For clients that don't want to track
all counters, they can watch when the counter gets high, and then only
track counters that get so high, to count the number of wraps.

Sam