Re: Question about nf_conntrack_proto for IPsec

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Naruto Nguyen <narutonguyen2018@xxxxxxxxx> wrote:
> In linux/latest/source/net/netfilter/ folder, I only see we have
> nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other
> conntrack implementations for other protocols but I do not see
> nf_conntrack_proto for IPsec, so does it mean connection tracking
> cannot track ESP or AH protocol as a connection. I mean when I use
> "conntrack -L" command, I will not see ESP or AH  connection is saved
> in conntrack list. Could you please help me to understand if conntrack
> supports that and any reasons if it does not support?

ESP/AH etc. use the generic tracker, i.e. only one ESP connection
is tracked between each endpoint.



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux