Re: [RFC ulogd patch 0/1] Implement conntrack event filter in NFCT input

[Eric Leblond <eric@regit.org>]

[-- Attachment #1: Type: text/plain, Size: 938 bytes --]

Hello,

Sorry for being late to reply here.

Le jeudi 02 août 2012 à 13:23 +0200, Pablo Neira Ayuso a écrit :
> On Wed, Aug 01, 2012 at 11:33:28PM +0200, Eric Leblond wrote:
> > 
> > Hello,
...
> Note that ulogd2 initially dumps the entire table. The filtering will
> not apply to dumping, only to events.

Why is this needed ? This gave us more accurate stats about existing
connection by filling the hash at start ?

> 
> You need to filter filter dumps.
> 
> conntrackd already has a framework for user-space filtering, that is
> used for filter. You can grab it. We can probably later move it to
> libnetfilter_conntrack to avoid code redundancy.

I've looked at this part of the code but the implementation seems to
need a lot of conntrackd things like vector. This seems a bit too big to
include inside ulogd.

BR,
-- 
Eric Leblond 
Blog: http://home.regit.org/ - Portfolio: http://regit.500px.com/

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]