Hello, On Mar 9 2007 09:35, Amin Azez wrote: >* Jan Engelhardt wrote, On 08/03/07 20:26: >> xt_portscan needs to keep track of what packets the machine has already >> seen. So on the first SYN, the connection is marked with "1". (Then we >> send our SYN-ACK... and the connection turns ESTABLISHED.) The next >> packet that is received will be an ACK or an RST. But it must come >> _exactly after_ the SYN, so just using --tcp-flags ACK will not work. A >> state which can be remembered is required. For that, an automaton is >> used, whose state is saved in the connection mark. > >There would me more point in having this as a new match if it didn't >trample on the connection mark, but used it's own slot or flag-bit.
Adding a member to the ip_conntrack/nf_conntrack and sk_buff struct would increase the struct sizes, and that would penalize users who do not intend to use xt_portscan. I do not see why the packet/connection marks should not be used to record additional information. After all, that is what users use marks for. xt_portscan can be precisely configured how to set its marks (mask is supported), so that it only takes away 4 bits of the 32-bit connection mark and 1 bit of the 32-bit packet mark. Almost never I required connection marking myself except for this portscanning automaton and perhaps a little MARK here and there for finely-tuned SNAT. Again, things might look different on your side(s). QoS, while primarily using CLASSIFY, is one point where MARK can be used. I would assume that those who use xt_portscan should be fine with the remaining 24 bits. Thank you, Jan -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/