Matching UDP broadcasts using RELATED
For protocols which work by initiating a request using a UDP broadcast and expecting a reply for a specific host, is there any way to match the reply back to the original broadcast.
An example of something that does this is smbmount, a request is broadcast to the localnet with a port set to the netbios-ns port, and then smbmount expects a reply from a particular host to the initiating port.
[email protected] - Sun, Jan 04, 2004:
Quoted 7 lines
For protocols which work by initiating a request using a UDP broadcast and expecting a reply for a specific host, is there any way to match the reply back to the original broadcast.
An example of something that does this is smbmount, a request is broadcast to the localnet with a port set to the netbios-ns port, and then smbmount expects a reply from a particular host to the initiating port.
I think this should go in a conntrack module, but there's always the possibility for you to write such rules manually with the "recent" module. See ``iptables -m recent --help''.
Regards,
Signature · 1 line
Loïc Minier <[email protected]>
Quoted 7 lines · On Sunday 04 January 2004 2:14 am, [email protected] wrote:
For protocols which work by initiating a request using a UDP broadcast and expecting a reply for a specific host, is there any way to match the reply back to the original broadcast.
An example of something that does this is smbmount, a request is broadcast to the localnet with a port set to the netbios-ns port, and then smbmount expects a reply from a particular host to the initiating port.
Not with the existing connection tracking code, no.
It shouldn't be too hard to write a conntrack helper for such a protocol which enables reply packets to be recognised as Related, however - all it would need to do is match:
destination IP = original source IP
destination port = original source port
source IP is within network range of original broadcast destination IP source port = original destination port
If you wanted to do a 'quick and dirty' version then you could even not bother about the source IP, and match packets where just the other three were correct - this would then be an almost trivial hack of the current conntrack code, I expect.
Regards,
Antony.
Signature · 4 lines
Ramdisk is not an installation procedure.
Please reply to the list;
please don't CC me.