conntrack

conntrack

[Stephen Clark]

Hi,

Does connection tracking keep any counters on number of packets/and or 
bytes that are
associated with a connection? If so how does one access them?

Thanks,
Steve

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Pablo Neira Ayuso]

On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
> Hi,
> 
> Does connection tracking keep any counters on number of packets/and
> or bytes that are
> associated with a connection? If so how does one access them?

echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct

Then, you can access them via:

conntrack -L

Re: conntrack

[Stephen Clark]

On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>    
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>      
> echo 1>  /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>    
Thanks

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Stephen Clark]

On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>    
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>      
> echo 1>  /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>    
Hi Pablo,

I have been working with FreeBSD for about 10 years and using ipfilter. 
It has a neat tool ipfstat -t which show the state table
sort of like top. It is very useful if someone is hogging the network 
because it is sorted by the highest user first. We are switching
our systems to Linux and would like to know fs there anything like this 
for conntrack?

Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes

Source IP             Destination IP         ST   PR   #pkts    
#bytes       ttl
192.168.198.105,5353  224.0.0.251,5353      0/0  udp   22598   
3736235      1:57
10.0.254.32,631       10.0.255.255,631      0/0  udp   11872   
2623712      1:29
192.168.198.103,5353  224.0.0.251,5353      0/0  udp   10608   
1720665      1:56
192.168.198.103,5353  224.0.0.251,5353      0/0  udp   10608   
1720665      1:56
10.0.254.32,5353      224.0.0.251,5353      0/0  udp    9807   
1680621      1:56
10.0.254.32,5353      224.0.0.251,5353      0/0  udp    9806   
1680485      1:56
192.168.198.166,50676 192.168.198.75,8181   4/4  tcp    2412   1548504  
81:09:04
192.168.198.148,137   192.168.198.255,137   0/0  udp   18625   
1452750      1:51
10.0.254.32,631       10.0.255.255,631      0/0  udp    6082   
1344122      1:29
192.168.198.148,137   192.168.198.255,137   0/0  udp   14186   
1107048      1:51
10.0.129.11,5353      224.0.0.251,5353      0/0  udp    5841   
1016739      1:56
10.0.129.11,5353      224.0.0.251,5353      0/0  udp    5840   
1016566      1:56
192.168.198.148,137   192.168.198.255,137   0/0  udp   12427    
969306      1:51
10.0.133.2,34114      216.17.35.103,143     4/4  tcp   13118    852888 
119:59:36
192.168.198.105,5353  224.0.0.251,5353      0/0  udp    3790    
828335      1:57
192.168.198.8,5353    224.0.0.251,5353      0/0  udp    5856    
826713      1:57
192.168.198.8,5353    224.0.0.251,5353      0/0  udp    5856    
826713      1:57
192.168.198.108,5353  224.0.0.251,5353      0/0  udp    5850    
813786      1:56
192.168.198.108,5353  224.0.0.251,5353      0/0  udp    5850    
813786      1:56


-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Chris Wilson]

Hi Stephen,

On Wed, 15 Feb 2012, Stephen Clark wrote:

> I have been working with FreeBSD for about 10 years and using ipfilter. It 
> has a neat tool ipfstat -t which show the state table
> sort of like top. It is very useful if someone is hogging the network because 
> it is sorted by the highest user first. We are switching
> our systems to Linux and would like to know fs there anything like this for 
> conntrack?
>
> Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes
>
> Source IP             Destination IP         ST   PR   #pkts    #bytes 
> ttl
> 192.168.198.105,5353  224.0.0.251,5353      0/0  udp   22598   3736235 
> 1:57

iftop does something like this, not looking at the conntrack table but it 
may help.

Cheers, Chris.
-- 
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES

Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.

conntrack

[Pawel Oleksik]

Hello,

I'd like to check the 'conntrack' tool. However, I can not compile it.
(Actually, I cannot compile libnetfilter_conntrack-0.0.20)
There is neither "linux_list.h" nor
"libnetfilter_conntrack/libnetfilter_conntrack_extensions.h" header files.
I know, where to find the first of them, but what about the second?

Could you give me some hints?

P.O.

Re: conntrack

[Ralf Spenneberg]

You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
while compiling.

Ralf

Am Samstag, den 05.11.2005, 21:20 +0100 schrieb Pawel Oleksik:
> Hello,
> 
> I'd like to check the 'conntrack' tool. However, I can not compile it.
> (Actually, I cannot compile libnetfilter_conntrack-0.0.20)
> There is neither "linux_list.h" nor
> "libnetfilter_conntrack/libnetfilter_conntrack_extensions.h" header files.
> I know, where to find the first of them, but what about the second?
> 
> Could you give me some hints?
> 
> P.O.
> 
-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Re: conntrack

[Pawel Oleksik]

On Sat, Nov 05, 2005 at 09:54:57PM +0100, Ralf Spenneberg wrote:
> You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
> while compiling.
> 
> Ralf
> 

Of course, I did it.
Actually, I've compiled 2.6.14 but still running 2.6.13.
So, for configuration of I run:
./configure --with-kernel=/usr/src/linux-2.6.14

But it didn't help.

P.O.

ps. The mentioned file
(libnetfilter_conntrack/libnetfilter_conntrack_extensions.h) is not present in
any of sources of: libnetfilter_conntrack-0.0.20, libnfnetlink-0.0.11,
conntrack-0.90, iptables-1.3.[34].

Moreover, linux_list.h is in sources of iptables-1.3.4, but installation will
not copy it in any include/ directiory. So, one has to do it himself.

Re: conntrack

[Ralf Spenneberg]

Hmh,

well I did not use the released versions but the subversion versions.
They worked for me.

Ralf
Am Sonntag, den 06.11.2005, 09:02 +0100 schrieb Pawel Oleksik:
> On Sat, Nov 05, 2005 at 09:54:57PM +0100, Ralf Spenneberg wrote:
> > You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
> > while compiling.
> > 
> > Ralf
> > 
> 
> Of course, I did it.
> Actually, I've compiled 2.6.14 but still running 2.6.13.
> So, for configuration of I run:
> ./configure --with-kernel=/usr/src/linux-2.6.14
> 
> But it didn't help.
> 
> P.O.
> 
> ps. The mentioned file
> (libnetfilter_conntrack/libnetfilter_conntrack_extensions.h) is not present in
> any of sources of: libnetfilter_conntrack-0.0.20, libnfnetlink-0.0.11,
> conntrack-0.90, iptables-1.3.[34].
> 
> Moreover, linux_list.h is in sources of iptables-1.3.4, but installation will
> not copy it in any include/ directiory. So, one has to do it himself.
-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Re: conntrack

[Pawel Oleksik]

On Sun, Nov 06, 2005 at 09:44:26AM +0100, Ralf Spenneberg wrote:
> Hmh,
> 
> well I did not use the released versions but the subversion versions.
> They worked for me.
> 
> Ralf

Positive! The SVN version works. (I hope they will change default download to
a right version soon.)

Thanks for the suggestion.

So, I will be back with questions how to use it :)

P.O.

conntrack

[Mohamed Eldesoky]

How does conntrack work ??
Does it care if the source/destination IPs change as well, due to load
balancers ??
I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
and continue the communications with it.
Does conntrack recognize that ?

-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: conntrack

[Mohamed Eldesoky]

???

On 7/31/05, Mohamed Eldesoky <eldesoky.lists@gmail.com> wrote:
> How does conntrack work ??
> Does it care if the source/destination IPs change as well, due to load
> balancers ??
> I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
> that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
> and continue the communications with it.
> Does conntrack recognize that ?
> 
> -- 
> Mohamed Eldesoky
> www.eldesoky.net
> RHCE
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: conntrack

[Jan Engelhardt]

>???

Doubting your own post?


>On 7/31/05, Mohamed Eldesoky <eldesoky.lists@gmail.com> wrote:
>> How does conntrack work ??
>> Does it care if the source/destination IPs change as well, due to load
>> balancers ??
>> I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
>> that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
>> and continue the communications with it.
>> Does conntrack recognize that ?
>> 
>> -- 
>> Mohamed Eldesoky
>> www.eldesoky.net
>> RHCE
>> 
>
>
>-- 
>Mohamed Eldesoky
>www.eldesoky.net
>RHCE
>
>

Jan Engelhardt
-- 
| Alphagate Systems, http://alphagate.hopto.org/

conntrack

[Corin Langosch]

Hi all,

i used to use iptables conntrack module. as our servers are really
busy and get a lot of connections, we got a lot of errors like
conntrack: table full, dropping packet. due to resource limits
we dont want to increase the conntrack_max limit, its currently
set to something about 32000.

how can we configure iptables so that some ports are excluded
from being tracked? as most connections are incomming on only
around 5 different ports all problems should be solved with
such an option :)

is there anything like iptables --notrack -dport 80 ..?
would be great!!

thanks for any help,
corin