Naruto Nguyen <narutonguyen2018@xxxxxxxxx> wrote: > In linux/latest/source/net/netfilter/ folder, I only see we have > nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other > conntrack implementations for other protocols but I do not see > nf_conntrack_proto for IPsec, so does it mean connection tracking > cannot track ESP or AH protocol as a connection. I mean when I use > "conntrack -L" command, I will not see ESP or AH connection is saved > in conntrack list. Could you please help me to understand if conntrack > supports that and any reasons if it does not support? ESP/AH etc. use the generic tracker, i.e. only one ESP connection is tracked between each endpoint.
