Re: conntrack doesn't always work when a bridge is used

["Damien Thébault" <damien.thebault@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 744 bytes --]

On Dec 20, 2007 12:25 PM, Patrick McHardy <kaber@trash.net> wrote:
>
> Thanks. Could you also post a tcpdump and enable conntrack logging
> by doing "echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid"
> and post the output of that, if any (you also need to load ipt_LOG
> in case you're not using some other logging backend).
>

I captured three times. The first time ("bad1" files), the reply is
coming back, but the ftp client doesn't seem to handle it. The second
time ("bad2" files), there is a problem with sequence numbers. And
then the last time ("good" files), it's ok.

I had sequence number errors without the previous bridge patch which
get merged in net-2.6. So I'll try again with the net-2.6 kernel.

-- 
Damien Thebault

[-- Attachment #2: capture_ftp_bad1_router.pcap --]
[-- Type: application/cap, Size: 8577 bytes --]

[-- Attachment #3: capture_ftp_bad2_router.pcap --]
[-- Type: application/cap, Size: 9077 bytes --]

[-- Attachment #4: capture_ftp_good_router.pcap --]
[-- Type: application/cap, Size: 8240 bytes --]

[-- Attachment #5: capture_ftp_bad1.pcap --]
[-- Type: application/cap, Size: 8577 bytes --]

[-- Attachment #6: capture_ftp_bad2.pcap --]
[-- Type: application/cap, Size: 8719 bytes --]

[-- Attachment #7: capture_ftp_good.pcap --]
[-- Type: application/cap, Size: 8240 bytes --]