Le 03/10/2017 à 14:32, Will Sewell a écrit :
This makes me still unclear on how conntrack figures out that the original and reply packets are related. e.g. from the information in the packet entering netfilter in the reply direction, how can it determine that it is part of the same connection as the packet entering netfilter in the original direction. I'll try and figure this out and reply to this thread if I do.
Quite simple. After conntrack has seen the first original packet leave, it knows what a reply packet should look like when it enters. Roughly, a packet entering netfilter in the reply direction is the reverse of a packet leaving netfilter in the original direction.
-- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
