Re: nf_conntrack.acct has no effect

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> xt_conntrack for example has a nicer effect: once you add a rule that
> contains it, it will load nf_conntrack_ipv{4,6}, which in turn causes
> Netfilter to start tracking in the first place.
> 
> So along the lines, xt_connbytes could pin a module (or perhaps
> something more light-weight) to ultimately signify
> "forced-activation"/"deactivation-impossible", much like you cannot
> remove nf_conntrack while an xt_conntrack-using rule is in place.

It doesn't have to be forced IMO, but yes, the automatic enabling
should be similar to what xt_conntrack does.

> Then only one thing remains. As for nf_conntrack, once it is loaded,
> it picks up already-running connections (and loses them as soon
> as you rmmod it). This is not the case with accounting as far as I
> have observed yesterday - only new connections get to have (or
> not to have) an acct structure; existing ones are not modified
> or picked up like conntrack does.

Thats not possible using ct_extend.