Pablo Neira Ayuso | 16 Jul 12:23 2009

libnetfilter_conntrack 0.0.100 release


The Netfilter project presents libnetfilter_conntrack-0.0.100.

libnetfilter_conntrack is a userspace library providing a programming
interface (API) to the in-kernel connection tracking state table. This
library requires a linux kernel >= 2.6.18.

This release includes a couple of minor fixes. See ChangeLog for more

You can download it from:

on behalf of the Netfilter Core Team.
Pablo Neira Ayuso (31):
      src: remove old deprecated API
      build: reset age interface since old API has been removed
      src: remove reminiscent of NFCT_DIR_ORIGINAL and old prototypes
      src: add support for GRE transport protocol
      src: add support for UDPlite transport protocol
      include: deprecate several header files with obsolete enums
      src: remove debian/ directory
      header: refresh nfnetlink_conntrack.h copy
      src: add initial DCCP support
(Continue reading)

Pablo Neira Ayuso | 17 Jul 13:00 2009

conntrack-tools 0.9.13 released


The netfilter project presents another development release of the
conntrack-tools that includes support for all the protocol helpers
available in 2.6.30 that were missing so far (SCTP, UDPlite, DCCP and
GRE). The daemon updates includes a fix for a memory leak that can be
triggered under heavy load and if you set a hashtable in user-space that
is smaller than the one in the kernel. Moreover, it adds initial support
for DCCP and SCTP state-synchronization.

Please, see changelog attached for more details.

Q: How stable are the conntrack-tools?
A: This software is under development. Nevertheless, it has been tested
in a cluster environment composed of two stateful firewalls running
Debian 4.0 (Etch) with a Linux kernel 2.6.28, keepalived 1.1.15, using
conntrackd in FT-FW mode, randomly (in periods of 10 seconds) setting
links down to force the fail-over between the nodes. The results has
shown no hangs/closure in any TCP connection.

Q: What are the conntrack-tools?
A: The conntrack-tools are:

- The userspace daemon so-called conntrackd that covers the specific
aspects of stateful Linux firewalls to enable high availability
solutions. It can be used as statistics collector of the firewall use as
well. The daemon is highly configurable and easily extensible.

- The command line interface (CLI) conntrack that provides an interface
to add, delete and update flow entries, list current active flows in
(Continue reading)