From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Sam Roberts <vieuxtech@gmail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: can libnetfilter_conntrack be used to write a userspace connection tracker?
Date: Thu, 17 Feb 2011 00:12:13 +0100 [thread overview]
Message-ID: <4D5C59CD.3080701@netfilter.org> (raw)
In-Reply-To: <AANLkTim9ANWYvJ5NGBt_8roRLzC21Kep1ZGHU48nwkPY@mail.gmail.com>
On 16/02/11 18:52, Sam Roberts wrote:
> On Wed, Feb 16, 2011 at 5:20 AM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> Probably you have hit one of the bugs that went into 2.6.37. Please, try
>> the patch attached. IIRC, this is fixed in -stable and 2.6.38 and later
>> kernels.
>
> Since I'm not yet building my kernels from source, its easier for me
> to build a newer kernel than to find an old one and patch it.
>
> Stable is 2.6.37, I'll try 2.6.38-rc5.
I'm using 2.6.37 with the patch that I sent you in one of my firewalls:
$ uname -a
Linux debian2 2.6.37 #7 SMP Mon Feb 7 10:34:10 UTC 2011 x86_64 GNU/Linux
Everything works fine.
> userspace connection trackers seems a bit bleading edge, I'd be happy
> to build your latest code from git if you point me to it.
http://git.netfilter.org/cgi-bin/gitweb.cgi?p=conntrack-tools.git;a=summary
It's stable, I'll release 1.0 soon.
Some more work can be done on it to port it to libmnl, add H323 and SIP
support, active-active support, among tons of many other improvements.
But that can be done in the future.
> I'm now two steps back since upgrading from ubuntu's default kernel
> 2.6..35 and tools 0.9.14.
>
> It used to be everything but setting expectations was working for me,
> but I no longer get updates at all about the conntrack table, and
> neither does conntrack -E or -L:
>
> % sudo conntrack -L conntrack
> conntrack v0.9.15 (conntrack-tools): 0 flow entries have been shown.
As said, here works fine with the patch that I attached ;-)
prev parent reply other threads:[~2011-02-16 23:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-12 21:25 can libnetfilter_conntrack be used to write a userspace connection tracker? Sam Roberts
2011-01-12 21:36 ` Pablo Neira Ayuso
2011-02-16 0:08 ` Sam Roberts
2011-02-16 13:20 ` Pablo Neira Ayuso
2011-02-16 17:52 ` Sam Roberts
2011-02-16 23:12 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D5C59CD.3080701@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=vieuxtech@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.