Hi Florian, Thanks a lot for your reply. Could you please elaborate more on how generic tracker tracks ESP connection? Brs, Bao On Wed, 26 Jun 2019 at 18:13, Florian Westphal <fw@xxxxxxxxx> wrote: > > Naruto Nguyen <narutonguyen2018@xxxxxxxxx> wrote: > > In linux/latest/source/net/netfilter/ folder, I only see we have > > nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other > > conntrack implementations for other protocols but I do not see > > nf_conntrack_proto for IPsec, so does it mean connection tracking > > cannot track ESP or AH protocol as a connection. I mean when I use > > "conntrack -L" command, I will not see ESP or AH connection is saved > > in conntrack list. Could you please help me to understand if conntrack > > supports that and any reasons if it does not support? > > ESP/AH etc. use the generic tracker, i.e. only one ESP connection > is tracked between each endpoint.
