On Thu, Apr 07, 2016 at 07:30:57PM +0200, Mart Frauenlob wrote: > On 07.04.2016 11:45, Pablo Neira Ayuso wrote: > >also applied. > > > > I'd update the man page also, but I'm unsure about the wording. > Is there a description of the tables dying and unconfirmed > somewhere in the source? Or maybe someone can help me out with a > brief description? Let me give it a try: 'dying' shows the conntrack entries that have expired and that have been destroyed by the connection tracking itself or via the conntrack utility. 'unconfirmed' shows new entries that are not yet inserted into the conntrack table, these entries are attached to packets that are traversing the stack, but that did not reach the confirmation point at the postrouting hook. These two new tables are basically only useful for debugging purposes. Under normal operation, it is hard to see entries in any of these two tables. Well, to be preciuse, there are still two "normal cases" where you could see entries there: 1) when packets that are enqueued via nfqueue, or 2) when conntrackd runs in event reliable mode. But these are kind of corner cases where it is valid to see entries in the unconfirmed table. Feel free to reword/improve/adapt it for the manpage. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
