* Setting NOTRACK on all tcp connections
@ 2010-12-01 14:35 Raviv
2010-12-01 14:42 ` Pascal Hambourg
0 siblings, 1 reply; 3+ messages in thread
From: Raviv @ 2010-12-01 14:35 UTC (permalink / raw)
To: netfilter
Hi,
I'm developing a module that should mark DSCP values on SIP and related
RTP connections.
For that task i have created the relevant rules.
However i would to use the conntrack only for theses udp (SIP and RTP)
connections.When testing in heavy TCP load environment i got the
conntrack table full.
I tried to setup a rule for notracking TCP connections as follows:
iptables -t raw -A PREROUTING -p tcp -j NOTRACK
but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.
How do i set the rule for tcp NOTRACK?
Thanks,
Raviv
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Setting NOTRACK on all tcp connections
2010-12-01 14:35 Setting NOTRACK on all tcp connections Raviv
@ 2010-12-01 14:42 ` Pascal Hambourg
2010-12-01 14:47 ` Jan Engelhardt
0 siblings, 1 reply; 3+ messages in thread
From: Pascal Hambourg @ 2010-12-01 14:42 UTC (permalink / raw)
To: netfilter
Hello,
Raviv a écrit :
>
> I tried to setup a rule for notracking TCP connections as follows:
>
> iptables -t raw -A PREROUTING -p tcp -j NOTRACK
>
> but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.
If these TCP connections are established by the host, you need to add
the same rule in the OUTPUT chain too. Also if you have IPv6 traffic you
need to add the same rules with ip6tables.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Setting NOTRACK on all tcp connections
2010-12-01 14:42 ` Pascal Hambourg
@ 2010-12-01 14:47 ` Jan Engelhardt
0 siblings, 0 replies; 3+ messages in thread
From: Jan Engelhardt @ 2010-12-01 14:47 UTC (permalink / raw)
To: Pascal Hambourg; +Cc: netfilter
On Wednesday 2010-12-01 15:42, Pascal Hambourg wrote:
>Raviv a écrit :
>>
>> I tried to setup a rule for notracking TCP connections as follows:
>>
>> iptables -t raw -A PREROUTING -p tcp -j NOTRACK
>>
>> but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.
>
>If these TCP connections are established by the host, you need to add
>the same rule in the OUTPUT chain too. Also if you have IPv6 traffic you
>need to add the same rules with ip6tables.
And since we're ultramodern, it's actually
-p tcp -j CT --notrack
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-12-01 14:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-12-01 14:35 Setting NOTRACK on all tcp connections Raviv
2010-12-01 14:42 ` Pascal Hambourg
2010-12-01 14:47 ` Jan Engelhardt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.