Pablo Neira Ayuso wrote:
[]
For nowadays tools, in case we've seen "new" but not "remove" event,
that connection will be in our hash table sorta forever (ok, till
restart). Which is, I think, worse than not logging it at all (it
will not be logged anyway).
Basically, I don't see such a case (lost "remove" event) as valid.
I have a couple of patches here that I'm still working on it here to
avoid "remove" event loss. It should be ready for review once the
nf-next-2.6 tree is open.
Well, I didn't know it can occur to start with :) But it's good to
know it's almost fixed -- thanks!
To know when a flow starts and avoid the problem of "new" event loss. I
think that we can still add a conntrack extension to store the start
time. I think that's enough, right?
It is _exactly_ what I'm talking/asking about. To say - Does anyone
have an objection to that?
Which time to use is entirely another question. Should it be 'ticks'
or 'jiffies' or like time(2)/gettimeofday(2) with all the fun stuff
about system time resets etc..... Oh well.
Thanks.
/mjt
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
