simple question about state vs conntrack modules
recently i have read a nice documentation with some hints for making
good rulesets .... and one caught my attention
http://jengelh.medozas.de/documents/Perfect_Ruleset.pdf
Towards the perfect ruleset
Jan Engelhardt
August 2009
5 Modern extensions
De-facto obsolete extensions:
* -m state: replaced by -m conntrack
i must confess i dont recall reading about state module being
obsoleted by conntrack one ..... is that true ??? I know conntrack has more options .... but that it obsoleted state, that i dont remember ....
Signature · 8 lines
Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email [email protected] My SPAMTRAP, do not email it
Quoted 9 lines · Leonardo Rodrigues
recently i have read a nice documentation with some hints for making good
rulesets .... and one caught my attentionhttp://jengelh.medozas.de/documents/Perfect_Ruleset.pdf
Towards the perfect ruleset
Jan Engelhardt
August 2009
Quoted 7 lines
5 Modern extensions
De-facto obsolete extensions:
* -m state: replaced by -m conntracki must confess i dont recall reading about state module being obsoleted by
conntrack one ..... is that true ??? I know conntrack has more options .... but that it obsoleted state, that i dont remember ....
Technically the conntrack match supersedes - and so obsoletes - the state match. But practically the state match is not obsoleted in any way.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
Jozsef Kadlecsik escreveu:
Quoted 11 lines
Quoted 8 lines
5 Modern extensions
De-facto obsolete extensions:
* -m state: replaced by -m conntracki must confess i dont recall reading about state module being obsoleted by
conntrack one ..... is that true ??? I know conntrack has more options .... but that it obsoleted state, that i dont remember ....Technically the conntrack match supersedes - and so obsoletes - the state match. But practically the state match is not obsoleted in any way.
That's exactly what i tought ..... conntrack can offer more options,
but saying state is obsolete means, at least to me, that it's support and maintenance will be dropped soon and everybody HAVE TO stop using it and using something else.
well, nice to know state is NOT obsolete the way i understand
something is obsoleted.
thanks for your answer
Signature · 8 lines
Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email [email protected] My SPAMTRAP, do not email it