On 10/19/15 at 12:07am, Joe Stringer wrote: > > I'm probably missing something obvious. Why is the reply direction > > not considered NEW? Wouldn't this consider an ICMPv6 as related+new > > depending on simply the direction? > > My thoughts were along the lines "If something is a reply, that > implies that state is held, and therefore it cannot be NEW (where NEW > means no state is available)". However, if you consider that the > 'related' connection is an independent connection with its own state, > but the 'reply' bit refers to the original connection, my original > premise breaks. Furthermore, looking at how it's used in netfilter > core and the ICMP proto handler, it looks like both of these cases > should be considered NEW. I can respin. > > Do you have a specific case in mind here? It would be useful for > extending the OVS testsuite.
It's tricky. A typical use case would be an active FTP connection where the data connection is established in the reply direction and marked related if I'm not mistaken. OTOH, an ICMP sent in response should not be considered NEW. It really depends on our definition of NEW towards the user. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
