Is it possible to use event-driven connection tracking - with conntrack-utils
or by other means?
Ideally, what I would like to do is 'register' a handler for particular
connection events (when new connection is established and then closed for
example) based on particular pre-defined filter (say, by protocol,
source/destination ip etc) and execute a program code/function (if done
programmatically) or a script (if done outside the connection-tracking domain)
to do what I want?
conntrack -Ee NEW,DESTROY
would list you the specified events as they happen. Combined with a
script that reacts when a new line is outputted by conntrack should
do the trick.
That's not what I am after!
If I want to poll a text output every-so-often I can use
/proc/net/nf_conntrack for that. I am after event-driven tracking
(without the polling!), informing me when the conditions I initially set
are satisfied (connection status, source IP, destination IP etc) and I
pick up the rest (again, via a program interface or a script if there is
no other choice). A bit like (ng-)cron, but with set filters which
trigger the events (as oppose to timing as is the case with cron).
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
