Atomic get-and-watch of conntrack table

Atomic get-and-watch of conntrack table

[Paul Evans]

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]

I'd like to write a long-running program that regularly reports
statistics on conntrack usage (total number of connections, number of
NATs, etc...). To do this, the program needs to start up, grab the
current state of the table, and be informed of updates.

This presents a problem. You can't pass conntrack -L -E together.

So either:

 a: I run "conntrack -L", then watch "conntrack -E", with the inherent
    race condition inbetween where state might change while I'm not
    looking

or

 b: I start watching "conntrack -E", then run "conntrack -L", with more
    subtle race conditions involved in the fact that I might get events
    from the -E command which set the state I've already seen by the -L
    list; so having to filter those out somehow.

Is there any alternative to this; can I atomically get the current
table, and watch for updates to it? If not I guess I'll have to go for
a careful implementation of case b- start watching, scrape the current
table, and be prepared for "DELETE" or "UPDATE" events to touch items
in the table I don't yet know about, or "NEW" or "UPDATE" events to set
state that I've now already seen... tricky indeed...

-- 
Paul Evans <paul@mxtelecom.com>
Tel: +44 (0) 845 666 7778
Fax: +44 (0) 870 163 4694
http://www.mxtelecom.com

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: Atomic get-and-watch of conntrack table

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 888 bytes --]

Hello,

Le lundi 01 juin 2009 à 18:36 +0100, Paul Evans a écrit :
> I'd like to write a long-running program that regularly reports
> statistics on conntrack usage (total number of connections, number of
> NATs, etc...). To do this, the program needs to start up, grab the
> current state of the table, and be informed of updates.

You could use ulogd-2 which has the ability of following the conntrack.
It can dump conntrack information inside a database and you can query it
to get your data. By using a custom SQL procedure (or custom output
plugin), you can even output what you want.

An other possibility is to use conntrackd which has a statistic mode.

Link:
ulogd2: http://www.netfilter.org/projects/ulogd/
conntrackd: http://conntrack-tools.netfilter.org/manual.html

BR,
-- 
Eric Leblond <eric@inl.fr>
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]