Re: ICMP conntrack

[Vincent Lim <vincent.lim@nestac.com>]

Antony Stone wrote:
> 
> On Friday 18 October 2002 10:05 am, Cedric Blancher wrote:
> 
> > Le ven 18/10/2002 à 10:28, Antony Stone a écrit :
> > > > I was wondering why I'm not getting any conntrack entires for icmp
> > > > connections?
> > >
> > > There is no concept of a "connection" for ICMP.
> >
> > Yes it's true, but for some, you have a request/reply concept.
> 
> Yes, I realised that was the only exception after I posted my reply.
> 
> > > A single ICMP packet is sent to indicate some situation has occurred.
> > > There's no reply, there's no follow-up packet, therefore there's no need
> > > to keeptrack of a "connection" for something which consists of only a
> > > single packet.
> >
> > Two cases :
> >
> >       request/reply : echo, timestamp, address mask and info
> >               First packet (request) is NEW, others (replies) are
> >               ESTABLISHED ; entries have a 30s timeout.
> >               If a unsolicitated reply is received, then INVALID.
> 
> Indeed.
> 
> >       ICMP erros : ICMP payload is a quotation extracted from the IP
> >               packet that has generated the error. This quotation is
> >               used to identify the related session in conntrack table.
> >               If ICMP match an active entry, then it's RELATED. If
> >               not, it's INVALID.
> 
> Although I agree with what you've said here, it's not really relevant to the
> original poster's question, because in these cases you'll still never see an
> ICMP entry in the connection tracking table.   Because the ICMP packets are
> RELATED to the original connection, it's the original packet which you'll see
> in the conntrack table - the ICMP replies simply get through because of their
> relationship to the original packet.
> 
> > So, for ICMP requests, you have some kind of conntrack, based on ICMP
> > sequence number. For ICMP errors, conntrack tries to associate them to
> > an existing entry.
> 
> ICMP sequence number ???   What's that ?

Results of a ping to www.ncftpd.com :

64 bytes from ncftpd.com (209.197.102.38): icmp_seq=11055 ttl=44
time=311.029 msec
64 bytes from ncftpd.com (209.197.102.38): icmp_seq=11056 ttl=44
time=308.126 msec
64 bytes from ncftpd.com (209.197.102.38): icmp_seq=11057 ttl=44
time=308.430 msec
64 bytes from ncftpd.com (209.197.102.38): icmp_seq=11058 ttl=44
time=302.321 msec

And the entries in conntrack related to the above is:
icmp     1 29 src=192.168.1.229 dst=209.197.102.38 type=8 code=0
id=59475 src=209.197.102.38 dst=192.168.1.229 type=0 code=0 id=59475
use=1 

However if I try to ping a nearer host, there would be no entry in the
conntrack table at all.

-- 
Vincent Lim
Software Engineer
NESTAC Solution Sdn Bhd
vincent.lim@nestac.com | +(6012) 659-6609