From: Mike Jones on
Responding to buck:

> Mike Jones <luck(a)dasteem.invalid> wrote in
> news:pan.2010.06.10.16.54.29(a)dasteem.invalid:
>
>> I'm wondering if IPtables sees them as NEW because they're on different
>> outgoing ports, but the client sees them as incoming
>> ESTABLISHED,RELATED.
>>
>> Maybe its an IPtables thing?
>
> Does
> [cat|less|most] /proc/net/ip_contrack
> help you decide if that's the case? I'm pretty sure that iptables makes
> its decisions about state based on the entries there.


Hmmm.

I get 8 tcp to my ISP, all ESTABLISHED


Fire up a client box, do an ssh connection from that...

Now I have one extra.

3 tcp 6 431960 ESTABLISHED src=192.168.1.4 dst=192.168.1.1
sport=34436 dport=22 packets=36 bytes=4973 src=192.168.1.1
dst=192.168.1.4 sport=22 dport=34436 packets=74 bytes=19349 [ASSURED]
mark=0 use=1

I'll have to make sometime to poke around in this intriguing rabbit hole.

--
*=( http://www.thedailymash.co.uk/
*=( For all your UK news needs.