From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: "connection tracking" and "Connection state"? Date: Tue, 1 Apr 2003 22:37:48 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200304012237.48814.netfilter@newkirk.us> References: Reply-To: netfilter@newkirk.us Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: SB CH , netfilter@lists.netfilter.org On Tuesday 01 April 2003 08:18 pm, SB CH wrote: > Hello, all. > > connection tracking(stateful inspection) has a relation with this > menu(make config)? > > "Connection tracking match support" > > But when I deselect this menu, I can use connection tracking like > NEW,ESTABLISHED,RELATED etc. > I think that only "Connection state match support" menu is required to > use this function. > > then what is the function and meaning of the "Connection tracking > match support"? As I just found out (Thanks Martin Josefsson!) there is available a=20 conntrack match. It lets you match more than the three conntrack states=20 you mentioned - you can match conntrack status like ASSURED, SEEN_REPLY,=20 etc, as well as 'states' SNAT and DNAT (matches packets which have been=20 SNATted or DNATted) and also match the original pre-SNAT/pre-DNAT IPs. http://netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.ht= ml#ss3.3 j