* UDP entries do not list ctstate
@ 2008-02-19 0:13 Jan Engelhardt
2008-02-19 0:39 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Jan Engelhardt @ 2008-02-19 0:13 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Netfilter Developer Mailing List
Hi,
to figure out what Netfilter actually does, we add a rule to match
incoming DNS replies for demonstrational purposes:
iptables -I INPUT -p udp --sport 53 -m conntrack --ctstate
ESTABLISHED
as one would expect, ESTABLISHED matches. Now, after the DNS reply has
been received, running `conntrack -L | grep udp` does not show the
string "ESTABLISHED" at all, even if I run it within the UDP conntrack
timeout. Glitch/Bug in /usr/sbin/conntrack?
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: UDP entries do not list ctstate
2008-02-19 0:13 UDP entries do not list ctstate Jan Engelhardt
@ 2008-02-19 0:39 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2008-02-19 0:39 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Netfilter Developer Mailing List
Hi Jan,
Jan Engelhardt wrote:
> to figure out what Netfilter actually does, we add a rule to match
> incoming DNS replies for demonstrational purposes:
>
> iptables -I INPUT -p udp --sport 53 -m conntrack --ctstate
> ESTABLISHED
>
> as one would expect, ESTABLISHED matches. Now, after the DNS reply has
> been received, running `conntrack -L | grep udp` does not show the
> string "ESTABLISHED" at all, even if I run it within the UDP conntrack
> timeout. Glitch/Bug in /usr/sbin/conntrack?
The output is compatible with /proc/net/ip_conntrack which doesn't show
the generic states for UDP. Instead, it shows the flag assured when we
have seen traffic in both directions.
BTW, you can also `use conntrack -L -p udp' to filter so you don't need
to use grep for this particular case.
--
"Los honestos son inadaptados sociales" -- Les Luthiers
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-02-19 0:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-02-19 0:13 UDP entries do not list ctstate Jan Engelhardt
2008-02-19 0:39 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.