Hi Sai "loose mode" is the default for Linux/BSD/userpsace DP.
I think this default makes sense because the most common use cases are: moving a connection from one instance of a firewall (stateless or stateful) to another. With loose mode disabled, we would drop the subsequent packets. Moving from no protection to some form of protection is less common and in that case, everything that happened before and the existing endpoint states are all tainted anyways. Thanks Darrell On Thu, Mar 8, 2018 at 10:43 AM, Ben Pfaff <[email protected]> wrote: > On Wed, Mar 07, 2018 at 05:39:22PM -0800, Sairam Venugopal wrote: > > Established TCP Connections could potentially form invalid Conntrack > > Entries when OVS is getting installed or the Conntrack Flows are applied. > > Prevent this from happening by explicitly requiring SYN packets to be > > present for creating new Conntrack entries. > > > > Signed-off-by: Sairam Venugopal <[email protected]> > > I think that this is the opposite of the policy direction that we're > pursuing in the userspace connection tracker. Darrell, do I understand > that correctly? > _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
