Linux Netfilter discussions
 help / color / mirror / Atom feed
* Is there way to bypass conntrack?
@ 2003-09-03 17:47 Andrey Tverdokhleb
  2003-09-04 17:52 ` Julian Gomez
  0 siblings, 1 reply; 2+ messages in thread
From: Andrey Tverdokhleb @ 2003-09-03 17:47 UTC (permalink / raw)
  To: netfilter

I'd really like to have some way to bypass ip_conntrack for some 
packets. Basically I need to run very intensive port scanning through my 
firewall and as soon as ip_conntrack loaded it dies within seconds from 
syn flood. Increase limit doesnt work becuase I need about  127000 
packets to be sent from different source ports. So far I just keep 
contrack unloaded and firewall works fine as pure stateless filter. But 
now I need statefull inspection on this machine for some IPs. So the 
question - is it possible to avoid connection tracking for some specific 
IPs?

Thanks!

Andrey



^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Is there way to bypass conntrack?
  2003-09-03 17:47 Is there way to bypass conntrack? Andrey Tverdokhleb
@ 2003-09-04 17:52 ` Julian Gomez
  0 siblings, 0 replies; 2+ messages in thread
From: Julian Gomez @ 2003-09-04 17:52 UTC (permalink / raw)
  To: netfilter

On Wed, Sep 03, 2003 at 10:47:06AM -0700, Andrey Tverdokhleb spoke thusly:

>I'd really like to have some way to bypass ip_conntrack for some 
>packets. Basically I need to run very intensive port scanning through my 
>firewall and as soon as ip_conntrack loaded it dies within seconds from 
>syn flood. Increase limit doesnt work becuase I need about  127000 
>packets to be sent from different source ports. So far I just keep 
>contrack unloaded and firewall works fine as pure stateless filter. But 
>now I need statefull inspection on this machine for some IPs. So the 
>question - is it possible to avoid connection tracking for some specific 
>IPs?

I think there is a NOTRACK patch somewhere (p-o-m / archives) ? Try looking
for it, from memory I think that is what you need.


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2003-09-04 17:52 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-09-03 17:47 Is there way to bypass conntrack? Andrey Tverdokhleb
2003-09-04 17:52 ` Julian Gomez

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox