* Is there way to bypass conntrack?
@ 2003-09-03 17:47 Andrey Tverdokhleb
2003-09-04 17:52 ` Julian Gomez
0 siblings, 1 reply; 2+ messages in thread
From: Andrey Tverdokhleb @ 2003-09-03 17:47 UTC (permalink / raw)
To: netfilter
I'd really like to have some way to bypass ip_conntrack for some
packets. Basically I need to run very intensive port scanning through my
firewall and as soon as ip_conntrack loaded it dies within seconds from
syn flood. Increase limit doesnt work becuase I need about 127000
packets to be sent from different source ports. So far I just keep
contrack unloaded and firewall works fine as pure stateless filter. But
now I need statefull inspection on this machine for some IPs. So the
question - is it possible to avoid connection tracking for some specific
IPs?
Thanks!
Andrey
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Is there way to bypass conntrack?
2003-09-03 17:47 Is there way to bypass conntrack? Andrey Tverdokhleb
@ 2003-09-04 17:52 ` Julian Gomez
0 siblings, 0 replies; 2+ messages in thread
From: Julian Gomez @ 2003-09-04 17:52 UTC (permalink / raw)
To: netfilter
On Wed, Sep 03, 2003 at 10:47:06AM -0700, Andrey Tverdokhleb spoke thusly:
>I'd really like to have some way to bypass ip_conntrack for some
>packets. Basically I need to run very intensive port scanning through my
>firewall and as soon as ip_conntrack loaded it dies within seconds from
>syn flood. Increase limit doesnt work becuase I need about 127000
>packets to be sent from different source ports. So far I just keep
>contrack unloaded and firewall works fine as pure stateless filter. But
>now I need statefull inspection on this machine for some IPs. So the
>question - is it possible to avoid connection tracking for some specific
>IPs?
I think there is a NOTRACK patch somewhere (p-o-m / archives) ? Try looking
for it, from memory I think that is what you need.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-09-04 17:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-09-03 17:47 Is there way to bypass conntrack? Andrey Tverdokhleb
2003-09-04 17:52 ` Julian Gomez
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox