Re: [conntrackd] Question about expect table sync

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Todor,

I'm cc'ing netfilter users to keep this in the record.

todor.gamishev@orange-ftgroup.com wrote:
> Hello Pablo,
> 
> I'm actually working on High Availability of stateful firewalls and I'm
> testing the conntrackd tool coupled with keepalived. I was wondering if
> conntrackd could synchronize the conntrack EXPECT table too. I've played
> with it all the day but I cannot get my EXPECT table synchronized. So,
> could you please tell me if it's possible at all with conntrackd v0.9.14?

We are not synchronizing the expectation table but we do synchronize
confirmed expectations that are attached to their master conntrack (I'm
refering to the RELATED state in iptables).

Expectations usually have a short lifetime and they occur in early
stages of the flow establishment. I consider that synchronizing
expectations do not help too much to improve availability under recovery
situations but it requires extra computational resources for this.