Hi Rui,
Rui Sousa wrote:
I believe so, but I having a hard time understanding what I'm seeing.
AFAICT, I'm exercising the state transition sNo->sES->sES, my procedure is:
PC1 -> linux router -> PC2
1. establish TCP connection between two PC's (using iperf). PC1 is the client,
PC2 is the server.
2. On the router, ifdown of output interface (the interface on PC2 side)
3. On the router, manual destroy of connection in kernel
4. On the router, ifup of output interface
5. wait for iperf to start sending packets again. The connection between the
endpoints is always established.
Between 3 and 4 I receive a NFCT_DESTROY event (from libnetfilter_conntrack).
During 5. I get two events, both NFCT_UPDATEs, the first with conntrack status
CONFIRMED/SEEN_REPLY, the second with conntrack status ASSURED. Both are
missing the TCP protoinfo. In this is my problem, the kernel correctly picked
up the on going TCP connection but never sends enough information to
userspace about it.
Good analysis. Since Linux kernel 2.6.30, you should see a NFCT_NEW
event (for conntracks that have been created via ctnetlink) before you
get the two NFCT_UPDATE events. The NFCT_NEW contains the TCP protocol
state.
I guess that you're using an older Linux kernel.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
