On Tue, Aug 17, 2021 at 04:42:12PM +0200, Blažej Krajňák wrote:
> Hello Pablo,
> 
> I'm just rewriting input plugin ulog_inppkt_NFLOG.c to include
> conntrack params. I successfully included CT flags from enum
> ip_conntrack_status (assured, reply seen, ...) and CT state and
> direction from NFULA_CT_INFO.

Great.

> However, in NFULA_CT few counters from enum nf_conntrack_attr are
> still 0 value. For ex. ATTR_TIMESTAMP_START / STOP and
> ATTR_ORIG/REPL_COUNTER_PACKETS/BYTES.
> Is it normal, or am I missing some bug at parsing?

You need this kernel patch to add this information to nfnetlink_queue,
compile-tested only.