State of the conntrack match
clenggenhager at gmail.com
Wed May 2 08:14:07 CEST 2007
I would like to use a conntrack match (i.e. -m conntrack --ctorigdst
...), but I miss the ability to filter for the original source and
When going through the archives of netfilter-devel, I see that the
conntrack match has originally been developed by Marc Boucher.
Back in 2002, Henrik Nordström wrote a patch to it that would precisely
fit my needs.
Unfortunately, this effort seems to have died with the advise from
Harald Welte to contact Marc Boucher directly.
My questions are now:
- What is the status of the conntrack match? Is it just "there" to be
used, but nobody ever wants to touch it again?
- Would it be appreciated to take up Henrik's (old) ideas? Is there a
chance to take such changes into the main tree? Since I do not know
better: Is this a "good" idea or does it make you scream and run away?
Well, this is more a user-related question:
- Assuming conntrack match is too old and out-dated, is there an
alternative way to filter based on the original data (addresses and
ports) of a packet?
Thanks for any reply.
If this is a repost, please excuse, but I couldn't find my message in
the archives, so I resent it. Sorry for any inconveniences.
More information about the netfilter-devel