Re: [PATCH] conntrack: Add missing tables dying and unconfirmed to usage output.

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Apr 07, 2016 at 07:30:57PM +0200, Mart Frauenlob wrote:
> On 07.04.2016 11:45, Pablo Neira Ayuso wrote:
> >also applied.
> >
> 
> I'd update the man page also, but I'm unsure about the wording.
> Is there a description of the tables dying and unconfirmed
> somewhere in the source? Or maybe someone can help me out with a
> brief description?

Let me give it a try:

'dying' shows the conntrack entries that have expired and that have been
destroyed by the connection tracking itself or via the conntrack
utility.

'unconfirmed' shows new entries that are not yet inserted into the
conntrack table, these entries are attached to packets that are
traversing the stack, but that did not reach the confirmation point at
the postrouting hook.

These two new tables are basically only useful for debugging purposes.
Under normal operation, it is hard to see entries in any of these two
tables.

Well, to be preciuse, there are still two "normal cases" where you
could see entries there: 1) when packets that are enqueued via
nfqueue, or 2) when conntrackd runs in event reliable mode. But these
are kind of corner cases where it is valid to see entries in the
unconfirmed table.

Feel free to reword/improve/adapt it for the manpage.