From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Hi! The following patchset modifies the conntrack subsystem to ensure that nf_conn objects are always inserted in any of the existing lists, they are: the hashtable, the unconfirmed and the dying lists. ctnetlink is also extended to allow to dump their content. I know of people debugging issues using simple scripts like these below: DYING=`conntrack -L dying | wc -l` ACTIVE=`conntrack -L | wc -l` UNCONFIRMED=`conntrack -L unconfirmed | wc -l` TOTAL=`conntrack -C` echo "dying: $DYING" echo "active: $ACTIVE" echo "unconfirmed: $UNCONFIRMED" SUM=$(($DYING + $ACTIVE + $UNCONFIRMED)) echo "sum: $SUM" echo "total: $TOTAL" So you can track that the active+dying+unconfirmed don't deviate too much from global conntrack object counter. I needed to slightly change the current behaviour so all objects are inserted in the dying list while running through the destroy path. Before this, this list was only used in conntrackd with reliable event reporting were in using. Pablo Neira Ayuso (2): netfilter: nf_conntrack: improve nf_conn object traceability netfilter: ctnetlink: dump entries from the dying and unconfirmed lists include/net/netfilter/nf_conntrack.h | 2 +- include/uapi/linux/netfilter/nfnetlink_conntrack.h | 2 + net/netfilter/nf_conntrack_core.c | 25 ++--- net/netfilter/nf_conntrack_netlink.c | 110 +++++++++++++++++++- 4 files changed, 121 insertions(+), 18 deletions(-) -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
