libnetfilter_conntrack 0.0.81 release

DISCUSSION Pablo Neira Ayuso 4 participants 7 messages Jul 28, 2007 – Aug 11, 2007 netfilter

lore

Share & tools

lore

Pablo Neira Ayuso

author maintainer

2007-07-28 12:38 UTC #0 lore raw

Hi!

The netfilter project proudly presents libnetfilter_conntrack-0.0.81

libnetfilter_conntrack is a userspace library providing a programming interface (API) to the in-kernel connection tracking state table.

This release includes minor changes and bugfixes. See ChangeLog for more details. Upgrade is recommended.

You can download it from:

http://www.netfilter.org/projects/libnetfilter_conntrack/
ftp://ftp.netfilter.org/pub/libnetfilter_conntrack/

Pablo (on behalf of the Netfilter Project)

Signature · 2 lines

"Será preciso viajar a través de los ojos de los idiotas" -- Poeta en
Nueva York -- Federico García Lorca.

libnetfilter_conntrack 0.0.81
======================================================================

Changes from 0.0.80:

- add layer 4 protocol comparison to nfct_compare() [Pablo Neira Ayuso]

- introduce nfct_nfnlh() to use functions like nfnl_rcvbufsiz() [Pablo Neira Ayuso]

- remove unused build_id() from build.c
[Pablo Neira Ayuso]

m2

2007-07-30 06:08 UTC #1 lore raw

delete conntrack entry - how

hi,

I want to delete this stale conntrack entry:
conntrack -L
tcp 6 259996 ESTABLISHED src=85.214.110.62
dst=217.199.190.234 sport=44895 dport=80 packets=1 bytes=40 [UNREPLIED] src=217.199.190.234 dst=85.214.110.62 sport=80 dport=44895 packets=0 bytes=0 mark=0 use=1

iptstate shows:
Source Destination Proto State TTL
85.214.110.62:44895 217.199.190.234:80 tcp ESTABLISHED 72:10:59

so I dont want to wait 72 hours more;
I've already reduced some values,
e.g.
echo 216000

Quoted 1 line

/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established

but the connection was already EST

an example for deleteing such an entry within the man page would be fine

Regards

m2

2007-07-30 06:22 UTC #2 lore raw

delete conntrack entry - how

In reply to Pablo Neira Ayuso

hi,

iptstate shows:
Source Destination Proto State TTL
85.214.110.62:44895 217.199.190.234:80 tcp ESTABLISHED 72:10:59

so I dont want to wait 72 hours more;
I've already reduced some values,
e.g.
echo 216000

Quoted 1 line

/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established

but the connection was already EST

an example for deleteing such an entry within the man page would be fine

Regards

Signature · 4 lines

 . ___
 |  |  Irmund     Thum
 |  |  +49 6374 992542
       +49 163 9889576

fd4

2007-07-30 11:32 UTC #3 lore raw

delete conntrack entry - how

In reply to Pablo Neira Ayuso

hi,

iptstate shows:
Source Destination Proto State TTL
85.214.110.62:44895 217.199.190.234:80 tcp ESTABLISHED 72:10:59

so I dont want to wait 72 hours more;
I've already reduced some values,
e.g.
echo 216000

Quoted 1 line

/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established

but the connection was already EST

an example for deleteing such an entry within the man page would be fine

Regards

fd4

2007-07-30 14:12 UTC #4 lore raw

Re: delete conntrack entry - how

Quoted 2 lines

an example for deleteing such an entry within the man page would be fine

maybe this one (thanks to a readers help :-)
conntrack -D [conntrack] -s 172.16.31.31 -d 172.16.31.255 -p udp --orig-port-src 138 --orig-port-dst 138

fd4

2007-08-11 07:38 UTC #5 lore raw

Re: ip_conntrack growing indefinitely

In reply to fd4

Quoted 4 lines

For now it has been patched setting ip_conntrack_max to 65536 but connections still grow indefinitely (seems NAT never drops old connections). Any idea of the reasons? Could be related with the kernel version (2 years old) we're running?

I've a similar phenomen using kernel 2.6.18-4-vserver-686 :
conntrack -L|wc -l
3340
nearly all started at a similar time from two ports to random

example iptstate:
Source Destination Proto State TTL
1.2.3.4:42573 1.2.3.4:842 tcp ESTABLISHED 10:44:43 1.2.3.4:42574 1.2.3.4:1501 tcp ESTABLISHED 10:43:51 1.2.3.4:42573 1.2.3.4:1392 tcp ESTABLISHED 10:43:20

well :- on my wish list now something like that:
conntrack -D -s 1.2.3.4 -d 1.2.3.4 -p tcp --orig-port-src 42573 --orig-port-dst *

Eric Leblond

2007-08-11 08:04 UTC #6 lore raw

Re: ip_conntrack growing indefinitely

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Quoted 5 lines

Quoted 1 line
For now it has been patched setting ip_conntrack_max to 65536 but
well :- on my wish list now something like that:
conntrack -D -s 1.2.3.4 -d 1.2.3.4 -p tcp --orig-port-src 42573 --orig-port-dst *

You should try this:
http://software.inl.fr/trac/trac.cgi/wiki/pynetfilter_conntrack

It does exactly what you want.

BR,
- --
Eric Leblond <[email protected]>
NuFW, Now User Filtering Works : http://www.nufw.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGvW2PnxA7CdMWjzIRAn4xAJsFD/7db/FCNw6iwTByznnY5PDpdACfdegE pslZiNpAY6TtqT0F0Iw4HTw=
=6G59
-----END PGP SIGNATURE-----