>> I have been experimenting with logging conntrack flows using ulogd2. However, >> the numbers aren't stacking up against a simple iptables accounting rule... >> Is there an expectation that nf_conntrack should log every single byte in/out? >> >> An example seems to be to cause a name lookup via dnsmasq. For whatever reason >> this does two simultaneous dns requests to both configured dns servers. One >> reply comes back slightly quicker than the other and the slower reply appears >> to cause a local ICMP unreachable response to be generated. Everything is >> logged *except* the data for the ICMP unreachable response? >> >> So tcpdump gives me (note sizes are payload, add 28 to compare with conntrack): >> >> 22:23:40.151666 IP 10.141.36.76.25630 > 8.8.4.4.53: 11049+ AAAA? www.yahoo.co.uk. (33) >> 22:23:40.151993 IP 10.141.36.76.25630 > 8.8.8.8.53: 11049+ AAAA? www.yahoo.co.uk. (33) >> 22:23:40.850776 IP 8.8.4.4.53 > 10.141.36.76.25630: 11049 3/1/0 CNAME rc.yahoo.com., CNAME rc.g01.yahoodns.net., CNAME any-rc.a01.yahoodns.net. (178) >> 22:23:41.014108 IP 8.8.8.8.53 > 10.141.36.76.25630: 11049 3/1/0 CNAME rc.yahoo.com., CNAME rc.g01.yahoodns.net., CNAME any-rc.a01.yahoodns.net. (178) >> >> 22:23:41.014217 IP 10.141.36.76 > 8.8.8.8: ICMP 10.141.36.76 udp port 25630 unreachable, length 214 >> >> 22:23:41.401743 IP 10.141.36.76.10248 > 8.8.4.4.53: 25285+ A? www.yahoo.co.uk. (33) >> 22:23:41.764124 IP 8.8.4.4.53 > 10.141.36.76.10248: 25285 4/0/0 CNAME rc.yahoo.com., CNAME rc.g01.yahoodns.net., CNAME any-rc.a01.yahoodns.net., A 77.238.178.122 (133) >> >> >> However, conntrack gives me: >> >> May 9 22:24:10 localhost [DESTROY] ORIG: SRC=10.141.36.76 DST=8.8.4.4 PROTO=UDP SPT=25630 DPT=53 PKTS=1 BYTES=61 , REPLY: SRC=8.8.4.4 DST=10.141.36.76 PROTO=UDP SPT=53 DPT=25630 PKTS=1 BYTES=206 >> May 9 22:24:10 localhost [DESTROY] ORIG: SRC=10.141.36.76 DST=8.8.8.8 PROTO=UDP SPT=25630 DPT=53 PKTS=1 BYTES=61 , REPLY: SRC=8.8.8.8 DST=10.141.36.76 PROTO=UDP SPT=53 DPT=25630 PKTS=1 BYTES=206 >> May 9 22:24:11 localhost [DESTROY] ORIG: SRC=10.141.36.76 DST=8.8.4.4 PROTO=UDP SPT=10248 DPT=53 PKTS=1 BYTES=61 , REPLY: SRC=8.8.4.4 DST=10.141.36.76 PROTO=UDP SPT=53 DPT=10248 PKTS=1 BYTES=161 >> >> >> Basically it's missing any count for the packet with tcpdump timestamp: 22:23:41.014217 - ie the port unreachable response? This is confirmed by looking at the iptables counts > > Have you tried investigating whether the ICMP packets in question are > making it into any of the conntrack system? Maybe by using the userspace > program, or my using the conntrack match extension in iptables? I think that these UDP packets are completely missing the entire conntrack system? I am using ulogd2 to dump all the connections and the ones above are all that I see. Therefore either there is a bug in ulogd2 which isn't spitting out this connection or conntrack completely misses this packet? (arguably whether should it be applied to this connection or not mind?) I think you are leaning towards confirming this is unexpected and could be reported as a "bug"? I wrote up the above on the -devel list but didn't attract any comments so far It would be interesting to hear if this is a "bug" or expected? Cheers Ed W -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
