conntrack

conntrack

[Pawel Oleksik]

Hello,

I'd like to check the 'conntrack' tool. However, I can not compile it.
(Actually, I cannot compile libnetfilter_conntrack-0.0.20)
There is neither "linux_list.h" nor
"libnetfilter_conntrack/libnetfilter_conntrack_extensions.h" header files.
I know, where to find the first of them, but what about the second?

Could you give me some hints?

P.O.

Re: conntrack

[Ralf Spenneberg]

You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
while compiling.

Ralf

Am Samstag, den 05.11.2005, 21:20 +0100 schrieb Pawel Oleksik:
> Hello,
> 
> I'd like to check the 'conntrack' tool. However, I can not compile it.
> (Actually, I cannot compile libnetfilter_conntrack-0.0.20)
> There is neither "linux_list.h" nor
> "libnetfilter_conntrack/libnetfilter_conntrack_extensions.h" header files.
> I know, where to find the first of them, but what about the second?
> 
> Could you give me some hints?
> 
> P.O.
> 
-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Re: conntrack

[Pawel Oleksik]

On Sat, Nov 05, 2005 at 09:54:57PM +0100, Ralf Spenneberg wrote:
> You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
> while compiling.
> 
> Ralf
> 

Of course, I did it.
Actually, I've compiled 2.6.14 but still running 2.6.13.
So, for configuration of I run:
./configure --with-kernel=/usr/src/linux-2.6.14

But it didn't help.

P.O.

ps. The mentioned file
(libnetfilter_conntrack/libnetfilter_conntrack_extensions.h) is not present in
any of sources of: libnetfilter_conntrack-0.0.20, libnfnetlink-0.0.11,
conntrack-0.90, iptables-1.3.[34].

Moreover, linux_list.h is in sources of iptables-1.3.4, but installation will
not copy it in any include/ directiory. So, one has to do it himself.

Re: conntrack

[Ralf Spenneberg]

Hmh,

well I did not use the released versions but the subversion versions.
They worked for me.

Ralf
Am Sonntag, den 06.11.2005, 09:02 +0100 schrieb Pawel Oleksik:
> On Sat, Nov 05, 2005 at 09:54:57PM +0100, Ralf Spenneberg wrote:
> > You need Linux Kernel 2.6.14 and need to specifiy the kernel directory
> > while compiling.
> > 
> > Ralf
> > 
> 
> Of course, I did it.
> Actually, I've compiled 2.6.14 but still running 2.6.13.
> So, for configuration of I run:
> ./configure --with-kernel=/usr/src/linux-2.6.14
> 
> But it didn't help.
> 
> P.O.
> 
> ps. The mentioned file
> (libnetfilter_conntrack/libnetfilter_conntrack_extensions.h) is not present in
> any of sources of: libnetfilter_conntrack-0.0.20, libnfnetlink-0.0.11,
> conntrack-0.90, iptables-1.3.[34].
> 
> Moreover, linux_list.h is in sources of iptables-1.3.4, but installation will
> not copy it in any include/ directiory. So, one has to do it himself.
-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Re: conntrack

[Pawel Oleksik]

On Sun, Nov 06, 2005 at 09:44:26AM +0100, Ralf Spenneberg wrote:
> Hmh,
> 
> well I did not use the released versions but the subversion versions.
> They worked for me.
> 
> Ralf

Positive! The SVN version works. (I hope they will change default download to
a right version soon.)

Thanks for the suggestion.

So, I will be back with questions how to use it :)

P.O.

Logging connections into IPTables

[Daniel Guthrie]

 
I may be asking in the wrong area, but hopefully someone can point me in the
right direction.
 
Does anyone have an idea as to anything I could use to put the IPTable
connection attempts into a SQL table of some nature for another developer to
build off of. I'm only somewhat experienced with linux and very
inexperienced with IPTables, so I'm beating my head against the same walls.
 
Essentially, what we're doing is this -- using a *nix box to as a
provisioning server that updates firmware and configuration on customer's
VoIP ATAs via TFTP (port 69). The only catch is that we need to know which
customers have been updated. This can be done by comparing MAC addresses (of
the box logging in), but first I need to get the data into a table of some
nature or even just a regular file. I've looked at the log and seeing as how
it logs each packet, it's far too large to be of any use to me.
 
Any ideas? Just point me in a direction perhaps? Maybe an add-in of some
nature? I'd prefer to NOT do this with windows... Just because I'm not sure
if a Win box could handle everything properly.
 
Thanks for your time,
 
Daniel

RE: Logging connections into IPTables

[Rob Sterenborg]

> Does anyone have an idea as to anything I could use to put the IPTable
> connection attempts into a SQL table of some nature for another
> developer to build off of. I'm only somewhat experienced with linux
> and very inexperienced with IPTables, so I'm beating my head against
> the same walls.

Use Ulogd : http://gnumonks.org/gnumonks/projects/project_details?p_id=1


Gr,
Rob

Re: conntrack

[Chris Wilson]

Hi Stephen,

On Wed, 15 Feb 2012, Stephen Clark wrote:

> I have been working with FreeBSD for about 10 years and using ipfilter. It 
> has a neat tool ipfstat -t which show the state table
> sort of like top. It is very useful if someone is hogging the network because 
> it is sorted by the highest user first. We are switching
> our systems to Linux and would like to know fs there anything like this for 
> conntrack?
>
> Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes
>
> Source IP             Destination IP         ST   PR   #pkts    #bytes 
> ttl
> 192.168.198.105,5353  224.0.0.251,5353      0/0  udp   22598   3736235 
> 1:57

iftop does something like this, not looking at the conntrack table but it 
may help.

Cheers, Chris.
-- 
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES

Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.

Re: conntrack

[Stephen Clark]

On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>    
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>      
> echo 1>  /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>    
Hi Pablo,

I have been working with FreeBSD for about 10 years and using ipfilter. 
It has a neat tool ipfstat -t which show the state table
sort of like top. It is very useful if someone is hogging the network 
because it is sorted by the highest user first. We are switching
our systems to Linux and would like to know fs there anything like this 
for conntrack?

Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes

Source IP             Destination IP         ST   PR   #pkts    
#bytes       ttl
192.168.198.105,5353  224.0.0.251,5353      0/0  udp   22598   
3736235      1:57
10.0.254.32,631       10.0.255.255,631      0/0  udp   11872   
2623712      1:29
192.168.198.103,5353  224.0.0.251,5353      0/0  udp   10608   
1720665      1:56
192.168.198.103,5353  224.0.0.251,5353      0/0  udp   10608   
1720665      1:56
10.0.254.32,5353      224.0.0.251,5353      0/0  udp    9807   
1680621      1:56
10.0.254.32,5353      224.0.0.251,5353      0/0  udp    9806   
1680485      1:56
192.168.198.166,50676 192.168.198.75,8181   4/4  tcp    2412   1548504  
81:09:04
192.168.198.148,137   192.168.198.255,137   0/0  udp   18625   
1452750      1:51
10.0.254.32,631       10.0.255.255,631      0/0  udp    6082   
1344122      1:29
192.168.198.148,137   192.168.198.255,137   0/0  udp   14186   
1107048      1:51
10.0.129.11,5353      224.0.0.251,5353      0/0  udp    5841   
1016739      1:56
10.0.129.11,5353      224.0.0.251,5353      0/0  udp    5840   
1016566      1:56
192.168.198.148,137   192.168.198.255,137   0/0  udp   12427    
969306      1:51
10.0.133.2,34114      216.17.35.103,143     4/4  tcp   13118    852888 
119:59:36
192.168.198.105,5353  224.0.0.251,5353      0/0  udp    3790    
828335      1:57
192.168.198.8,5353    224.0.0.251,5353      0/0  udp    5856    
826713      1:57
192.168.198.8,5353    224.0.0.251,5353      0/0  udp    5856    
826713      1:57
192.168.198.108,5353  224.0.0.251,5353      0/0  udp    5850    
813786      1:56
192.168.198.108,5353  224.0.0.251,5353      0/0  udp    5850    
813786      1:56


-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Stephen Clark]

On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>    
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>      
> echo 1>  /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>    
Thanks

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Pablo Neira Ayuso]

On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
> Hi,
> 
> Does connection tracking keep any counters on number of packets/and
> or bytes that are
> associated with a connection? If so how does one access them?

echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct

Then, you can access them via:

conntrack -L

conntrack

[Stephen Clark]

Hi,

Does connection tracking keep any counters on number of packets/and or 
bytes that are
associated with a connection? If so how does one access them?

Thanks,
Steve

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: conntrack

[Jan Engelhardt]

>???

Doubting your own post?


>On 7/31/05, Mohamed Eldesoky <eldesoky.lists@gmail.com> wrote:
>> How does conntrack work ??
>> Does it care if the source/destination IPs change as well, due to load
>> balancers ??
>> I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
>> that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
>> and continue the communications with it.
>> Does conntrack recognize that ?
>> 
>> -- 
>> Mohamed Eldesoky
>> www.eldesoky.net
>> RHCE
>> 
>
>
>-- 
>Mohamed Eldesoky
>www.eldesoky.net
>RHCE
>
>

Jan Engelhardt
-- 
| Alphagate Systems, http://alphagate.hopto.org/

Re: conntrack

[Mohamed Eldesoky]

???

On 7/31/05, Mohamed Eldesoky <eldesoky.lists@gmail.com> wrote:
> How does conntrack work ??
> Does it care if the source/destination IPs change as well, due to load
> balancers ??
> I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
> that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
> and continue the communications with it.
> Does conntrack recognize that ?
> 
> -- 
> Mohamed Eldesoky
> www.eldesoky.net
> RHCE
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

conntrack

[Mohamed Eldesoky]

How does conntrack work ??
Does it care if the source/destination IPs change as well, due to load
balancers ??
I mean, if an outsider talks to x.y.z.1 and the load balancer forwards
that packet to x.y.z.2, so the outsider will get a reply from x.y.z.2
and continue the communications with it.
Does conntrack recognize that ?

-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

conntrack

[Corin Langosch]

Hi all,

i used to use iptables conntrack module. as our servers are really
busy and get a lot of connections, we got a lot of errors like
conntrack: table full, dropping packet. due to resource limits
we dont want to increase the conntrack_max limit, its currently
set to something about 32000.

how can we configure iptables so that some ports are excluded
from being tracked? as most connections are incomming on only
around 5 different ports all problems should be solved with
such an option :)

is there anything like iptables --notrack -dport 80 ..?
would be great!!

thanks for any help,
corin