Re: [PATCH nf-next] netfilter: nft_ct: make byte/packet expr more friendly

2016-07-11 Thread Pablo Neira Ayuso
On Tue, Jul 05, 2016 at 11:23:00PM +0800, Liping Zhang wrote: > From: Liping Zhang > > If we want to use ct packets expr, and add a rule like follows: > # nft add rule filter input ct packets gt 1 counter > > We will find that no packets will hit it, because >

Re: [PATCH nf-next] netfilter: nft_ct: make byte/packet expr more friendly

2016-07-05 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > If we want to use ct packets expr, and add a rule like follows: > # nft add rule filter input ct packets gt 1 counter > > We will find that no packets will hit it, because > nf_conntrack_acct is

[PATCH nf-next] netfilter: nft_ct: make byte/packet expr more friendly

2016-07-05 Thread Liping Zhang
From: Liping Zhang If we want to use ct packets expr, and add a rule like follows: # nft add rule filter input ct packets gt 1 counter We will find that no packets will hit it, because nf_conntrack_acct is disabled by default. So It will not work until we enable