Yoann Juet wrote: > Pablo Neira Ayuso wrote: >> Yoann Juet wrote: >>> Pablo Neira Ayuso wrote: >>>>> As you can see, this TCP connection is present: >>>>> >>>>> root@fw1-irt:~# conntrack -L |grep 34189 >>>>> conntrack v0.9.10 (conntrack-tools): 14 flow entries has been shown. >>>>> tcp 6 10581 ESTABLISHED src=172.18.244.10 dst=193.52.101.32 >>>>> sport=34189 dport=5222 packets=63 bytes=12039 src=193.52.101.32 >>>>> dst=172.18.244.10 sport=5222 dport=34189 packets=58 bytes=22146 >>>>> [ASSURED] mark=0 secmark=0 use=1 >>>> This is weird, look like some problem in your scripts or the commit is >>>> not working in node fw1-irt. The packet counters of the entry above >>>> show >>>> that this is the old entry which is stuck in the cache after the second >>>> failover. This should be deleted when fw1-irt's script issues the >>>> commit >>>> (conntrackd -c). Does the log file tells that the commit was >>>> successful? >>>> >>> I confirm that "conntrackd -c" is executed on FW1-IRT on the second >>> failover. FYI, my LSB script executes the following instructions (start= >>> new active node ; stop = new passive node): >>> >>> ... >>> case "$1" in >>> start) >>> conntrackd -c -C /etc/conntrackd.conf >>> conntrackd -f -C /etc/conntrackd.conf >>> conntrackd -R -C /etc/conntrackd.conf Please, add the following line here to your scripts: conntrackd -B -C /etc/conntrackd.conf Let me now if that fixes your problem. -- "Los honestos son inadaptados sociales" -- Les Luthiers -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
