are the four packet "states" all-encompassing?

are the four packet "states" all-encompassing?

[Robert P. J. Day]

  are the four conntrack states NEW, ESTABLISHED, RELATED and
INVALID all-encompassing?  that is, does every single packet
fall into one and only one of these states?

  more to the point, what decides that a packet is NEW, given
that it's possible for it to be categorized as NEW despite the
fact that it has no SYN bit set?  (i just noticed the part
in the docs about identifying traffic that's NEW but also
"-p tcp ! --syn".

rday

Re: are the four packet "states" all-encompassing?

[Cedric Blancher]

Le jeu 24/10/2002 à 13:37, Robert P. J. Day a écrit :
>   are the four conntrack states NEW, ESTABLISHED, RELATED and
> INVALID all-encompassing?  that is, does every single packet
> fall into one and only one of these states?

Yes.
One very packet can have one state, and one.

>   more to the point, what decides that a packet is NEW, given
> that it's possible for it to be categorized as NEW despite the
> fact that it has no SYN bit set?  (i just noticed the part
> in the docs about identifying traffic that's NEW but also
> "-p tcp ! --syn".

A NEW packet is a valid packet that can't be associated to an existing
conntrack entry.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: are the four packet "states" all-encompassing?

[Robert P. J. Day]

On 24 Oct 2002, Cedric Blancher wrote:

> Le jeu 24/10/2002 à 13:37, Robert P. J. Day a écrit :
> >   are the four conntrack states NEW, ESTABLISHED, RELATED and
> > INVALID all-encompassing?  that is, does every single packet
> > fall into one and only one of these states?
> 
> Yes.
> One very packet can have one state, and one.

so every syntactically correct ("well-formed"??) packet is one
of NEW, ESTABLISHED or RELATED, while all others are just
INVALID?  ok, i can accept that, thanks.

rday

Re: are the four packet "states" all-encompassing?

[Cedric Blancher]

Le jeu 24/10/2002 à 15:29, Robert P. J. Day a écrit :
> On 24 Oct 2002, Cedric Blancher wrote:
> > One very packet can have one state, and one. 
> so every syntactically correct ("well-formed"??) packet is one
> of NEW, ESTABLISHED or RELATED, while all others are just
> INVALID?  ok, i can accept that, thanks.

Yes and no, it is a bit more complicated...

INVALID applies to all packets for which ip_conntrack is not able to
give a state. As common examples :

	. TCP packets that does not complies to RFC 793
	. ICMP errors non related to existing flows
	. lack of memory or conntrack table full

So, well formed packets can sometimes fall into INVALID state, but it is
safe to DROP them.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: are the four packet "states" all-encompassing?

[Robert P. J. Day]

On 24 Oct 2002, Cedric Blancher wrote:

> Le jeu 24/10/2002 à 15:29, Robert P. J. Day a écrit :
> > On 24 Oct 2002, Cedric Blancher wrote:
> > > One very packet can have one state, and one. 
> > so every syntactically correct ("well-formed"??) packet is one
> > of NEW, ESTABLISHED or RELATED, while all others are just
> > INVALID?  ok, i can accept that, thanks.
> 
> Yes and no, it is a bit more complicated...
> 
> INVALID applies to all packets for which ip_conntrack is not able to
> give a state. As common examples :
> 
> 	. TCP packets that does not complies to RFC 793
> 	. ICMP errors non related to existing flows
> 	. lack of memory or conntrack table full
> 
> So, well formed packets can sometimes fall into INVALID state, but it is
> safe to DROP them.

ok, gotcha.  but none of that changes the assertion that each and
every packet will fall into one, and only one, of these four
states.  thanks.

rday