Re: How to register conntrack notifier

[Pablo Neira Ayuso <pablo@netfilter.org>]

Nils Rennebarth wrote:
> Hi,
> 
> The help text for NF_CONNTRACK_EVENTS reads:
>   If this option is enabled, the connection tracking code will
>   provide a notifier chain that can be used by other kernel code
>   to get notified about changes in the connection tracking state.
> which sounds just like what I need: I want to execute a callback
> whenever a conntrack gets destroyed. However studying
> nf_conntrack_netlink.c, nf_conntrack_ecache.c and related header files
> for quite a while now, i am still unable to figure out how to do that.
> 
> Can someone enlighten me?

You have to register a structure nf_ct_event_notifier with the callback
function, you have to look at nf_conntrack_ecache.c and
nf_conntrack_netlink.c. There one problem though since you can only
register one callback and that one is usually used by nf_conntrack_netlink.c

You can also catch events from user-space by means of
libnetfilter_conntrack, have a look at utils/, it includes some examples.