Changli Gao wrote: > On Fri, Nov 27, 2009 at 5:42 PM, Jozsef Kadlecsik > <kadlec@xxxxxxxxxxxxxxxxx> wrote: >> On Fri, 27 Nov 2009, Changli Gao wrote: >> >>> Yes, as nf_conntrack_tcp_timeout_loose_unreply implied, it is for >>> picked up connections. >> Connection pickup can be disabled by proper rules or by setting >> nf_ct_tcp_loose to zero. So in which environment this third method is >> required? I'm curious what triggered you to write your patch. >> > > In some condition, you can't disable it. It's why we export > nf_ct_tcp_loose. As a bridge, if its booting breaks connections, users > won't happy, so we must allow loose mode. That won't help much. If you're able to spoof packets, you might as well spoof packets for both direction so SEEN_REPLY is set. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
