KERNEL Conntrack system reporting wrongly

[sque]

Hi I have setup a gentoo machine with kernel 2.6.16-r7 (from gentoo sources). This machine works as nat router.

The problem is that at /proc/net/ip_conntrack connections are reported as ESTABLISHED rather than SYN_SET

e.g. (an entry from /proc/net/ip_conntrack):

[sque]

After more reading on the conntrack system, I discovered that the 3rd entry is the time-out in seconds, so at the previous example

[nielchiano]

I have no clue, but I'm also interested in the solution

[sque]

What was actually happening:
I was trying with nmap to scan random hosts for port 80. BUT the first packet of nmap was not SYN (as I thought), it was an ACK!

I dont know why nmap is doing this or why the connection tracking system takes it as an ESTABLISHED connection but its not SYN_SENT for sure.

The prob now is that I know a way to flood the conntrack with a simple nmap command, if an expert knows something more about this, plz reply here, but conntrack is NOT reporting wrongly as there was no SYN packet sent. sry:)
_________________
CAUTION: I am noob

[nielchiano]

[sque]

From the Iptables Tutorial 1.2.0
---------------------------------------------------------------------------------------------
As you have seen, packets may take on several different states within the kernel itself, depending on what protocol we are talking about. However, outside the kernel, we only have the 4 states as described previously. These states can mainly be used in conjunction with the state match which will then be able to match packets based on their current connection tracking state. The valid states are NEW, ESTABLISHED, RELATED and INVALID. The following table will briefly explain each possible state.

Table 7-1. User-land states
State Explanation
NEW The NEW state tells us that the packet is the first packet that we see.
This means that the first packet that the conntrack module sees,
within a specific connection, will be matched. For example, if we see a SYN
packet and it is the first packet in a connection that we see, it will match.
However, the packet may as well not be a SYN packet and still be
considered NEW. This may lead to certain problems in some instances,
but it may also be extremely helpful when we need to pick up lost
connections from other firewalls, or when a connection has already timed
out, but in reality is not closed.

ESTABLISHED The ESTABLISHED state has seen traffic in both directions and
will then continuously match those packets. ESTABLISHED connections are
fairly easy to understand. The only requirement to get into an ESTABLISHED state is
that one host sends a packet, and that it later on gets a reply from the other host.
The NEW state will upon receipt of the reply packet to or through the firewall change to
the ESTABLISHED state. ICMP reply messages can also be considered as ESTABLISHED,
if we created a packet that in turn generated the reply ICMP message.
-------------------------------------------------------------------------------------------------

I copied that part of tutorial, because it claryfies that a connection where there is only one-way traffic must be considered as NEW regardeless the type of traffic. I am lost! For me it looks like a bug in connection tracking system, so I removed the [NO ERROR] tag from the thread title.
_________________
CAUTION: I am noob

[mwhitlock]