From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Paddie O'Brien <paddieobrien@gmail.com>
Cc: "Gáspár Lajos" <swifty@freemail.hu>, netfilter@vger.kernel.org
Subject: Re: conntrack -E problem
Date: Tue, 21 Apr 2009 12:56:56 +0200 [thread overview]
Message-ID: <49EDA678.2010907@netfilter.org> (raw)
In-Reply-To: <3e67fcb10904200915y6d2cdf0dw9c634d7fc31b1a6d@mail.gmail.com>
Paddie O'Brien wrote:
>> Just a question:
>> Why would you track unsuccessful connections?
>> If a connection ATTEMPT is unsuccessful then there is no CONNECTION -> so
>> there is nothing to track about....
>
> I want to know who on our wireless network at work
> is attempting to connect to my machine.
>
> My (shaky) understanding was that with conntrack I would
> get a NEW event for any inbound first packet irrespective
> of whether it led to the creation of an ESTABLISHED
> connection or not.
No, at least the first packet must succesfully go through the whole
firewall code, otherwise it is not logged by the conntrack code.
--
"Los honestos son inadaptados sociales" -- Les Luthiers
prev parent reply other threads:[~2009-04-21 10:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-20 15:01 conntrack -E problem Paddie O'Brien
2009-04-20 15:20 ` Gáspár Lajos
2009-04-20 16:15 ` Paddie O'Brien
2009-04-21 10:56 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49EDA678.2010907@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter@vger.kernel.org \
--cc=paddieobrien@gmail.com \
--cc=swifty@freemail.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.