From: Amin Azez Subject: Re: [RFC] alternative to conntrack ID Date: Tue, 17 May 2005 17:12:55 +0100 Message-ID: <428A1807.8070708@ufomechanic.net> References: <424747E3.7000300@eurodev.net> <42502F8D.5030504@trash.net> <4254258E.5000204@eurodev.net> <42627BC4.8070103@trash.net> <20050429080242.GJ9735@sunbeam.de.gnumonks.org> <42789366.20702@ufomechanic.net> <4278B23A.7050406@trash.net> <4278B98E.7090707@ufomechanic.net> <427B8A46.8090006@trash.net> <427D26E7.8060701@ingate.com> <427D3EAF.3020200@trash.net> <427D41FA.5080506@ingate.com> <1115648236.25627.17.camel@nienna.balabit> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Harald Welte , Netfilter Development Mailinglist , Pablo Neira , Patrick McHardy Return-path: To: KOVACS Krisztian In-Reply-To: <1115648236.25627.17.camel@nienna.balabit> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netfilter-devel.vger.kernel.org KOVACS Krisztian wrote: > Probably Patrick was referring to a possible problem where the > following happens: a new connection is established and destroyed in a > very short time. If a new connection with the same tuple is created > before the timestamp increases (which is perfectly possible IMHO if you > have some slow embedded HW with no high precision timer available) After further reading I think this scenario is highly unlikely. I don't mean improbable, I mean, is there any such hardware? If a socket is not to be reused until TCP_TIME_WAIT which is recommended to be in the region of 4 minutes, is there really any hardware that can't time to that resolution? Is there really any devices that will re-use a TCP socket in the same timer tick as they closed it? Any devices that re-use sockets too quickly are going to have problems anyway (of course that doesn't mean we can ignore them) but I surely they are so buggy as to not remain in use? Amin > then > you won't be able to tell the difference in the userspace app, so that > the race described by Amin is still possible. >