[NFLOG] How to determine the connection a packet belongs to?

[NFLOG] How to determine the connection a packet belongs to?

[Clemens Eisserer]

Hi,

We are using ulog2/nflog for logging packets and connections, which
works quite well.

However we haven't found a reliable way to determine which packets
belong to which connection.
There seem to be two distinct IDs for both packets (nflog) as well as
connection IDs issued by conntrack,
is there some correlation between the two IDs?

Or is there any other (maybe even better) way to determine which
logged packet belongs to which connection?

Thank you in advance, Clemens

Re: [NFLOG] How to determine the connection a packet belongs to?

[Pablo Neira Ayuso]

On 06/06/11 16:26, Clemens Eisserer wrote:
> Hi,
> 
> We are using ulog2/nflog for logging packets and connections, which
> works quite well.
> 
> However we haven't found a reliable way to determine which packets
> belong to which connection.
> There seem to be two distinct IDs for both packets (nflog) as well as
> connection IDs issued by conntrack,
> is there some correlation between the two IDs?

No.

> Or is there any other (maybe even better) way to determine which
> logged packet belongs to which connection?

You can build the tuple from the packet in user-space to look up the
conntrack via libnetfilter_conntrack.

Re: [NFLOG] How to determine the connection a packet belongs to?

[Clemens Eisserer]

Hi,

> You can build the tuple from the packet in user-space to look up the
> conntrack via libnetfilter_conntrack.

How can I do that?

Assuming there are two open connections:
IP1:80       <----> IP2:39678
IP1:39678 <-----> IP2:80

How can I know which packet belongs to which connection?

Thanks, Clemens

Re: [NFLOG] How to determine the connection a packet belongs to?

[Jan Engelhardt]

On Tuesday 2011-06-07 12:40, Clemens Eisserer wrote:

>Hi,
>
>> You can build the tuple from the packet in user-space to look up the
>> conntrack via libnetfilter_conntrack.
>
>How can I do that?
>
>Assuming there are two open connections:
>IP1:80       <----> IP2:39678
>IP1:39678 <-----> IP2:80
>
>How can I know which packet belongs to which connection?

Because packets contain IP1, 80, IP2 and 39678.

Re: [NFLOG] How to determine the connection a packet belongs to?

[Srinivasa T N]

On 06/07/2011 04:10 PM, Clemens Eisserer wrote:
> Hi,
>
>> You can build the tuple from the packet in user-space to look up the
>> conntrack via libnetfilter_conntrack.
>
> How can I do that?
>
> Assuming there are two open connections:
> IP1:80<---->  IP2:39678
> IP1:39678<----->  IP2:80
>
> How can I know which packet belongs to which connection?
>
> Thanks, Clemens
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
Am not an expert, but can't you match the src and dst address/port in 
each packet?

Regards,
Seenu.