Hi Todor, I'm cc'ing netfilter users to keep this in the record. todor.gamishev@xxxxxxxxxxxxxxxxxx wrote: > Hello Pablo, > > I'm actually working on High Availability of stateful firewalls and I'm > testing the conntrackd tool coupled with keepalived. I was wondering if > conntrackd could synchronize the conntrack EXPECT table too. I've played > with it all the day but I cannot get my EXPECT table synchronized. So, > could you please tell me if it's possible at all with conntrackd v0.9.14? We are not synchronizing the expectation table but we do synchronize confirmed expectations that are attached to their master conntrack (I'm refering to the RELATED state in iptables). Expectations usually have a short lifetime and they occur in early stages of the flow establishment. I consider that synchronizing expectations do not help too much to improve availability under recovery situations but it requires extra computational resources for this. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
