Re: [conntrackd] Question about expect table sync

Re: [conntrackd] Question about expect table sync

[Pablo Neira Ayuso]

Hi Todor,

I'm cc'ing netfilter users to keep this in the record.

todor.gamishev@orange-ftgroup.com wrote:
> Hello Pablo,
> 
> I'm actually working on High Availability of stateful firewalls and I'm
> testing the conntrackd tool coupled with keepalived. I was wondering if
> conntrackd could synchronize the conntrack EXPECT table too. I've played
> with it all the day but I cannot get my EXPECT table synchronized. So,
> could you please tell me if it's possible at all with conntrackd v0.9.14?

We are not synchronizing the expectation table but we do synchronize
confirmed expectations that are attached to their master conntrack (I'm
refering to the RELATED state in iptables).

Expectations usually have a short lifetime and they occur in early
stages of the flow establishment. I consider that synchronizing
expectations do not help too much to improve availability under recovery
situations but it requires extra computational resources for this.

Re: [conntrackd] Question about expect table sync

[Pablo Neira Ayuso]

Hi Todor,

On 02/07/10 09:31, todor.gamishev@orange-ftgroup.com wrote:
> Hi Pablo,
> 
> Pablo Neira Ayuso a écrit :
>> We are not synchronizing the expectation table but we do synchronize
>> confirmed expectations that are attached to their master conntrack (I'm
>> refering to the RELATED state in iptables).
>>
>> Expectations usually have a short lifetime and they occur in early
>> stages of the flow establishment. I consider that synchronizing
>> expectations do not help too much to improve availability under recovery
>> situations but it requires extra computational resources for this.
> 
> Thank you very much for replying to my mail so quickly.
> 
> Yes I agree with you in some ways. However, I am working on SIP-capable
> firewalls and the SIP Applicative Layer Gateway in netfilter
> (nf_conntrack_sip) retrieves ports needed for the RTP traffic in the SIP
> message body and adds them in the expectation table. So, when the Master
> goes down the Backup doesn't know them and all RTP packets are dropped.

Indeed, as for now (conntrack-tools 0.9.14) we don't support SIP yet,
but it would require extra implementation work.