Re: event-driven connection tracking

[Mr Dash Four <mr.dash.four@googlemail.com>]

>> Is it possible to use event-driven connection tracking - with conntrack-utils
>> or by other means?
>>
>> Ideally, what I would like to do is 'register' a handler for particular
>> connection events (when new connection is established and then closed for
>> example) based on particular pre-defined filter (say, by protocol,
>> source/destination ip etc) and execute a program code/function (if done
>> programmatically) or a script (if done outside the connection-tracking domain)
>> to do what I want?
>>     
>
> conntrack -Ee NEW,DESTROY
>
> would list you the specified events as they happen. Combined with a 
> script that reacts when a new line is outputted by conntrack should
> do the trick.
>   
That's not what I am after!

If I want to poll a text output every-so-often I can use 
/proc/net/nf_conntrack for that. I am after event-driven tracking 
(without the polling!), informing me when the conditions I initially set 
are satisfied (connection status, source IP, destination IP etc) and I 
pick up the rest (again, via a program interface or a script if there is 
no other choice). A bit like (ng-)cron, but with set filters which 
trigger the events (as oppose to timing as is the case with cron).