conntrack -E problem

conntrack -E problem

[Paddie O'Brien]

Hi,

I asked iptables to log all inbound connection attempts:

iptables -I INPUT 1 -d myipaddress  -m state --state NEW -j LOG

I then asked conntrack to report the same events:

conntrack -E --event-mask NEW -d myipaddress

I assumed the above were equivalent but conntrack
does not report the same events as iptables, it seems
to miss unsuccessful connections.

I'd be grateful if anyone could tell me what's going on...
How can I get conntrack to report everything that iptables
does?

Thanks,
P

Re: conntrack -E problem

[Gáspár Lajos]

Paddie O'Brien írta:
> it seems to miss unsuccessful connections.
>   
Just a question:
Why would you track unsuccessful connections?
If a connection ATTEMPT is unsuccessful then there is no CONNECTION -> 
so there is nothing to track about....

Or am I wrong??? :D

Swifty

Re: conntrack -E problem

[Paddie O'Brien]

> Just a question:
> Why would you track unsuccessful connections?
> If a connection ATTEMPT is unsuccessful then there is no CONNECTION -> so
> there is nothing to track about....

I want to know who on our wireless network at work
is attempting to connect to my machine.

My (shaky) understanding was that with conntrack I would
get a NEW event for any inbound first packet irrespective
of whether it led to the creation of an ESTABLISHED
connection or not.

> Or am I wrong??? :D

Re: conntrack -E problem

[Pablo Neira Ayuso]

Paddie O'Brien wrote:
>> Just a question:
>> Why would you track unsuccessful connections?
>> If a connection ATTEMPT is unsuccessful then there is no CONNECTION -> so
>> there is nothing to track about....
> 
> I want to know who on our wireless network at work
> is attempting to connect to my machine.
> 
> My (shaky) understanding was that with conntrack I would
> get a NEW event for any inbound first packet irrespective
> of whether it led to the creation of an ESTABLISHED
> connection or not.

No, at least the first packet must succesfully go through the whole
firewall code, otherwise it is not logged by the conntrack code.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers