How to disable Connection Tracking runtime

How to disable Connection Tracking runtime

[Srinivas Murthy]

Hi,
 Is there a way to disable conntracking runtime?

 I see a lot of cpu time taken up by these fns:

__hash_conntrack
ipt_do_table
conn_hash_table_lookup

 I did see the perf tweaking params related to this but for test
purposes, I'd like to try w/ this disabled altogether (and going via/
the kernel config file is too painful for now).

Thanks.

Re: How to disable Connection Tracking runtime

[Jan Engelhardt]

On Tuesday 2008-05-06 05:38, Srinivas Murthy wrote:

>Hi,
> Is there a way to disable conntracking runtime?

Use -j NOTRACK.

Re: How to disable Connection Tracking runtime

[Srinivas Murthy]

I tried,

iptables -t raw -p all -j NOTRACK

I can see the rule installed.

However I still see these calls in the oprofile data.

_Sri

On Mon, May 5, 2008 at 11:19 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
>
>  On Tuesday 2008-05-06 05:38, Srinivas Murthy wrote:
>
>  >Hi,
>  > Is there a way to disable conntracking runtime?
>
>  Use -j NOTRACK.
>

Re: How to disable Connection Tracking runtime

[Srinivas Murthy]

Sorry I installed,
iptables -t raw -A PREROUTING -p all -j NOTRACK

On Tue, May 6, 2008 at 8:54 PM, Srinivas Murthy <codevana@gmail.com> wrote:
> I tried,
>
>  iptables -t raw -p all -j NOTRACK
>
>  I can see the rule installed.
>
>  However I still see these calls in the oprofile data.
>
>  _Sri
>
>
>
>  On Mon, May 5, 2008 at 11:19 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
>  >
>  >  On Tuesday 2008-05-06 05:38, Srinivas Murthy wrote:
>  >
>  >  >Hi,
>  >  > Is there a way to disable conntracking runtime?
>  >
>  >  Use -j NOTRACK.
>  >
>

Re: How to disable Connection Tracking runtime

[Philip Craig]

Srinivas Murthy wrote:
> Sorry I installed,
> iptables -t raw -A PREROUTING -p all -j NOTRACK

You'll need this for locally generated packets:
iptables -t raw -A INPUT -j NOTRACK

But note that these only disable conntracking.  You'll still see
ipt_do_table().

If you want to stop iptables too then you'll need to unload the various
iptables/conntrack/nat modules (there are lots of them).  Even this
doesn't quite remove it all: there are still netfilter hooks.

If they aren't built as modules then I don't think there is a solution
other than rebuilding the kernel.

Re: How to disable Connection Tracking runtime

[Philip Craig]

Philip Craig wrote:
> You'll need this for locally generated packets:
> iptables -t raw -A INPUT -j NOTRACK

Sorry:
iptables -t raw -A OUTPUT -j NOTRACK