Re: [PATCH 2/3][CONNTRACK] Introduce the pickup facilities to take over TCP connections

[Patrick McHardy <kaber@trash.net>]

Krzysztof Oledzki wrote:
> On Mon, 21 Aug 2006, Pablo Neira Ayuso wrote:
> 
>> You seem to be confused with the IPS_PICKUP flag: this flag must be
>> set for conntracks created from userspace via ctnetlink, thus the TCP
>> window tracking knows that it has to take over the valid window of TCP
>> sequences, once that happens this flag is unset.
> 
> 
> Hm, lets assume we have two firewalls for active-active configuration.
> How does the second firewall know that it should accept/drop a packet
> with specific seq number from connection that was previously handled by
> the first one?
> 
> Plase excuse me if this is obvious, but I wasn't able to find any
> information about how it was solved. All I found is the TODO file
> with:
> 
> o support for TCP window tracking
>         - at the moment you have to disable it:
>         echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal


I think the question is whether connections will bounce between nodes
multiple times or just once when a node fail. The former would need
to have the IPS_PICKUP flag constantly enabled.