CODEWITHSUNDEEP
linuxlinux-kerneliptablesnetfilterconntrack
budoattack
budoattack

Reputation: 475

Linux kernel conntrack drop statistics

In Linux kernel conntrack subsystem sources I see a lot of statistic ticks like this:

ret = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum, l4proto);
if (ret < 0) {
    /* Too stressed to deal. */
    NF_CT_STAT_INC_ATOMIC(net, drop);
    ret = NF_DROP;
    goto out;
}

But I really can't figure out how in Linux (from user-mode) can I check this statistics. F.e. where can I find conntrack drops count? There is nothing similar in /proc/sys/net/netfilter/nf_conntrack*.
Sorry if obvious.

Upvotes: 0

Views: 539

Answers (1)

tyChen
tyChen

Reputation: 1494

First, you can see the statics in some tools like netstat or ss or nstat.

Then the problem about how the NF_CT_STAT_INC_ATOMIC counts drop need to trace the function itself. I think it's more interesting to do it by yourself since you are curious about it.

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

From here we can see that actually count is in ct.stat->drop. By searching this you can find your answer.

Upvotes: 0

Related Questions