From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Cc: netfilter@vger.kernel.org
Subject: Re: conntrack: how to handle child process's NETLINK_NETFILTER
Date: Sun, 08 May 2011 18:47:02 +0200 [thread overview]
Message-ID: <4DC6C906.2070605@netfilter.org> (raw)
In-Reply-To: <87ei4azdfs.wl%chamas@h4.dion.ne.jp>
On 07/05/11 18:24, Ken-ichirou MATSUZAWA wrote:
> There is linux box which has two NICs. one for nomal usage, another is
> connected to mirrored port of network equipment (like L2/L3 switch).
> eth1 is connected to mirrored port.
[...]
> I think this let us implement netflow probe easy, without libpcap.
It should be hard to make a patch for the kernel to drop all the packets
after the last conntrack hook. Thus, the conntrack subsystem and ulogd2
can be used for flow-accounting in mirrored port configurations.
Let me know if this is what you want, it really took me a while to
understand what you want from your email.
next prev parent reply other threads:[~2011-05-08 16:47 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-07 16:24 conntrack: how to handle child process's NETLINK_NETFILTER Ken-ichirou MATSUZAWA
2011-05-08 16:47 ` Pablo Neira Ayuso [this message]
2011-05-09 10:40 ` Ken-ichirou MATSUZAWA
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DC6C906.2070605@netfilter.org \
--to=pablo@netfilter.org \
--cc=chamas@h4.dion.ne.jp \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.