Le 02/01/2018 à 22:56, André Paulsberg-Csibi (IBM Consultant) a écrit :
As far as I can tell - ESTABLISHED - is only for session based protocols like TCP . You will not see that for UDP or ICMP , as far as CONNTRACK is concerned . IN the ruleset it will fall under the STATE of ESTABLISHED , as IPTABLES understands that this is direct return traffic . However , like UDP it has no real "IP state" outside of IPTABLES and my guess this is why it not refered to in that state in CONNTRACK .
You could not be more wrong. Connection tracking handles state for UDP and ICMP. Iptables just checks the packet states assigned by conntrack.
-----Original Message----- I'm sure I'm missing something obvious but I am not seeing echo replies showing as ESTABLISHED when running: sudo conntrack -E
Do not confuse packet state and connection state. conntrack -E shows connection tracking events, not packet states. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
