Re: [RFC] XML output for libnetfilter_conntrack

[Amin Azez <azez@ufomechanic.net>]

* Amin Azez wrote, On 21/11/06 16:01:

> I suggest an alternative compact version from which greater verboseness
> might be justified.
> 
> <conntrack status="ASSURED" timeout="100">
>   <flow direction="original"  | <original
>                    packets="1" bytes="10">
>     <layer2 number="0" name="eth" vlan="2"
>             src="00:00:00:00:00:00" dst="00:00:00:00:00:00"/>
>     <layer3 number="2" name="ipv4" src="192.168.0.1" dst="92.1.0.253"/>
>     <layer4 number="16" name="udp" src="53" dst="53"/>
>   </flow>                     | </original>
>   <flow direction="reply"    | <reply
>       ... etc
>   </flow>                     | </reply>
> </conntrack>
> 
> I realise that layer2 isn't part of the main conntrack but it is part of
> my conntrack, so I put it in there. I guess at name and number for layer2.
> 
> Maybe sport and dport should be used for L4 and not src and dst again...??

We should include a timestamp and (short-term-unique) conntrack-id in
that, and maybe even a created time if we keep it (I can't remember now):

 <conntrack ctid="1378654" created="102837453" time="102837459"
timeout="100" status="ASSUERED">

Sam