Hi, On Fri, Sep 14, 2012 at 09:57:36AM -0500, Miguel Alejandro González wrote: > Hello > > I have some questions about how conntrack tuple handles ICMP error messages... > > When a ICMP error packet arrives containing an embedded UDP or TCP > packet, assuming there was already a UDP or TCP connection being > tracked by conntrack, what are the IP addresses of the tuple, the ones > from the ICMP error message or the ones from the embedded packet? It uses inner headers of the ICMP error message, ie. "the ones from the embedded packet". See net/ipv4/netfilter/nf_conntrack_proto_icmp.c > Also does the tuple saves port information in this case as well as icmp > type and code? Conntrack does not save any ICMP error information. > How does conntrack know that ICMP error message is related to an > existing connection? The conntrack code looks up for some existing entry by using the information in the inner headers of the ICMP error message. If no entry is found, the packet is considered invalid, and you can drop it with iptables ... -m state --state INVALID -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
