Re: Second failover failure with conntrackd - INVALID packets

[Pablo Neira Ayuso <pablo@netfilter.org>]

Yoann Juet wrote:
> Pablo Neira Ayuso wrote:
>> Yoann Juet wrote:
>>> Pablo Neira Ayuso wrote:
>>>>> As you can see, this TCP connection is present:
>>>>>
>>>>> root@fw1-irt:~# conntrack -L  |grep 34189
>>>>> conntrack v0.9.10 (conntrack-tools): 14 flow entries has been shown.
>>>>> tcp      6 10581 ESTABLISHED src=172.18.244.10 dst=193.52.101.32
>>>>> sport=34189 dport=5222 packets=63 bytes=12039 src=193.52.101.32
>>>>> dst=172.18.244.10 sport=5222 dport=34189 packets=58 bytes=22146
>>>>> [ASSURED] mark=0 secmark=0 use=1
>>>> This is weird, look like some problem in your scripts or the commit is
>>>> not working in node fw1-irt. The packet counters of the entry above
>>>> show
>>>> that this is the old entry which is stuck in the cache after the second
>>>> failover. This should be deleted when fw1-irt's script issues the
>>>> commit
>>>> (conntrackd -c). Does the log file tells that the commit was
>>>> successful?
>>>>
>>> I confirm that "conntrackd -c" is executed on FW1-IRT on the second
>>> failover. FYI, my LSB script executes the following instructions (start=
>>> new active node ; stop = new passive node):
>>>
>>> ...
>>> case "$1" in
>>>         start)
>>>                 conntrackd -c -C /etc/conntrackd.conf
>>>                 conntrackd -f -C /etc/conntrackd.conf
>>>                 conntrackd -R -C /etc/conntrackd.conf

Please, add the following line here to your scripts:

conntrackd -B -C /etc/conntrackd.conf

Let me now if that fixes your problem.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers