The netfilter project presents another development release of the
conntrack-tools that includes a new `-S' option for the command line
tool, and a generic infrastructure to allow using different protocols to
replicate state-changes, currently unicast UDP and multicast are supported.
= command line interface: conntrack =
* Add `-S' option to display in-kernel connection tracking system
statistics in a more human-friendly way (instead of cat'ting
* Add the new generic infrastructure to allow using different protocols
to replicate state-changes, currently unicast UDP and multicast are
supported. Now you can add your favourite protocol to propagate
state-changes. An example of the multi-dedicated link over multicast
# conntrackd -s link
multicast traffic device=eth3 status=RUNNING role=ACTIVE:
129181080 Bytes sent 198577788 Bytes recv
273376 Pckts sent 268759 Pckts recv
0 Error send 0 Error recv
BTW, although UDP and multicast are unreliable, using FT-FW mode
* Some cleanups and one compilation fix for Gentoo and Fedora.
See changelog attached for more details.
Q: How stable are the conntrack-tools?
A: This software is under development. Nevertheless, it has been tested
in a cluster environment composed of two stateful firewalls running
Debian 4.0 (Etch) with a Linux kernel 2.6.28, keepalived 1.1.15, using
conntrackd in FT-FW mode, randomly (in periods of 10 seconds) setting
links down to force the fail-over between the nodes. The results has
shown no hangs/closure in any TCP connection.
Q: What are the conntrack-tools?
A: The conntrack-tools are:
- The userspace daemon so-called conntrackd that covers the specific
aspects of stateful Linux firewalls to enable high availability
solutions. It can be used as statistics collector of the firewall use as
well. The daemon is highly configurable and easily extensible.
- The command line interface (CLI) conntrack that provides an interface
to add, delete and update flow entries, list current active flows in
plain text/XML, current IPv4 NAT'ed flows, reset counters, and flush the
complete connection tracking table among many other.