Re: How to access conntrack connection expiration in a netfilter module?

[Ed W <lists@wildgooses.com>]

Go on... I'm sure someone wants to have a stab at educating this twit on 
ways a netfilter module could do housekeeping and cleanup it's internal 
state when conntrack connections are destroyed (emphasis being on how to 
discover they have been destroyed in some timely manner?)

Thanks

Ed W

On 01/10/2012 22:17, Ed W wrote:
> Hi, I'm trying to update the opendpi-netfilter module to work with 
> more recent kernels and the ntop ndpi fork of the code (now that 
> opendpi seems to have gone away)
>
> The netfilter module registers a conntrack notifier in order to 
> release resources once a conntrack is destroyed
> https://github.com/ewildgoose/ndpi-netfilter/blob/master/src/main.c
> This is not possible though, if you also want to have conntrack events 
> through netlink... ( NF_CT_NETLINK grabs the conntrack notifier first)
>
> Now I have read the history on why this is the case, but what are the 
> obvious workarounds to this situation?  Can we extend the conntrack 
> connection with custom properties? Anything better than simply 
> scanning my flows occasionally and comparing with the conntrack list 
> to see if they have gone away?
>
> Thanks for any thoughts
>
> Ed W
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe 
> netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html