Hi again Yoann,

Yoann Juet wrote:
> I'm still facing the same difficulties with conntrack-tools 0.9.10 and
> kernel 2.6.28.
> 
> Log on FW1 after the second failover:
> 
> Feb  6 09:55:46 FW-DSI-1-IRT kernel: [ 1352.601798] RULE -1 -- DENY
> IN=eth0 OUT=eth1 SRC=193.52.101.32 DST=172.18.244.10 LEN=255 TOS=0x00
> PREC=0x00 TTL=62 ID=8698 DF PROTO=TCP SPT=5222 DPT=34189 WINDOW=501
> RES=0x00 ACK PSH URGP=0
> 
> As you can see, this TCP connection is present:
> 
> root@fw1-irt:~# conntrack -L  |grep 34189
> conntrack v0.9.10 (conntrack-tools): 14 flow entries has been shown.
> tcp      6 10581 ESTABLISHED src=172.18.244.10 dst=193.52.101.32
> sport=34189 dport=5222 packets=63 bytes=12039 src=193.52.101.32
> dst=172.18.244.10 sport=5222 dport=34189 packets=58 bytes=22146
> [ASSURED] mark=0 secmark=0 use=1

This is weird, look like some problem in your scripts or the commit is
not working in node fw1-irt. The packet counters of the entry above show
that this is the old entry which is stuck in the cache after the second
failover. This should be deleted when fw1-irt's script issues the commit
(conntrackd -c). Does the log file tells that the commit was successful?

The following attached patch adds more verbose output to tell you that
some old entries has been deleted. Just in case that you need more
information for troubleshooting.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers