No ICMP connections in /proc/net/ip_conntrack?

No ICMP connections in /proc/net/ip_conntrack?

[Asim Shankar]

Hi,

I can't see any ICMP entries in /proc/net/ip_conntrack. My setup is as follows:

Machine A: 
- Connected to the internet on eth0 and to a private (192.168.1.0/24) on eth1.
- iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Machines B and C:
- Connected to the private (192.168.1.0/24) network on eth0
- Default gateway: Machine A

Machine D:
- Connected to the internet

If I ssh/ftp/run a udp-echo client on machines A/B, connecting to
machine D, I can see the entries in /proc/net/ip_conntrack on machine
A.

However, if I "ping D" from A and B, then no entry seems to be present
in ip_conntrack. My understanding based on:
http://www.faqs.org/docs/iptables/icmpconnections.html is that I
should see something in ip_conntrack.

Am I missing something?

Thanks,
Regards,

-- Asim

Re: No ICMP connections in /proc/net/ip_conntrack?

[Jason Opperisano]

On Fri, Feb 11, 2005 at 11:47:37AM -0600, Asim Shankar wrote:
> However, if I "ping D" from A and B, then no entry seems to be present
> in ip_conntrack. My understanding based on:
> http://www.faqs.org/docs/iptables/icmpconnections.html is that I
> should see something in ip_conntrack.
> 
> Am I missing something?

yeah--you're just not that fast.  a conntrack entry is created when the
ICMP Echo-Request is received and removed when the Echo-Reply goes out.
the total elapsed time that the conntrack entry exists would be in the
very low millisecond range...and i don't think your cat is that fast.

-j

--
"Silly customer, you cannot hurt a Twinkie!"
        --The Simpsons

Re: No ICMP connections in /proc/net/ip_conntrack?

[Alistair Tonner]

On February 11, 2005 01:45 pm, Jason Opperisano wrote:
> On Fri, Feb 11, 2005 at 11:47:37AM -0600, Asim Shankar wrote:
> > However, if I "ping D" from A and B, then no entry seems to be present
> > in ip_conntrack. My understanding based on:
> > http://www.faqs.org/docs/iptables/icmpconnections.html is that I
> > should see something in ip_conntrack.
> >
> > Am I missing something?
>
> yeah--you're just not that fast.  a conntrack entry is created when the
> ICMP Echo-Request is received and removed when the Echo-Reply goes out.
> the total elapsed time that the conntrack entry exists would be in the
> very low millisecond range...and i don't think your cat is that fast.
>
> -j
	I can assure you Jason, my cat isn't that fast, in fact right now he's 
horizontal, on his back, purring up a storm... I doubt he'd be able to twitch 
a whisker in time.

	Alistair.
>
> --
> "Silly customer, you cannot hurt a Twinkie!"
>         --The Simpsons