Re: flow start_time

[Michael Tokarev <mjt@tls.msk.ru>]

Pablo Neira Ayuso wrote:
[]
>> For nowadays tools, in case we've seen "new" but not "remove" event,
>> that connection will be in our hash table sorta forever (ok, till
>> restart).  Which is, I think, worse than not logging it at all (it
>> will not be logged anyway).
>>
>> Basically, I don't see such a case (lost "remove" event) as valid.
> 
> I have a couple of patches here that I'm still working on it here to
> avoid "remove" event loss. It should be ready for review once the
> nf-next-2.6 tree is open.

Well, I didn't know it can occur to start with :)  But it's good to
know it's almost fixed -- thanks!

> To know when a flow starts and avoid the problem of "new" event loss. I
> think that we can still add a conntrack extension to store the start
> time. I think that's enough, right?

It is _exactly_ what I'm talking/asking about.  To say - Does anyone
have an objection to that?

Which time to use is entirely another question.  Should it be 'ticks'
or 'jiffies' or like time(2)/gettimeofday(2) with all the fun stuff
about system time resets etc.....  Oh well.

Thanks.

/mjt