[lkml]   [2003]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] patch for invalid packet time from ULOG target of iptables
On Sun, Aug 24, 2003 at 07:16:00AM -0700, Alex Davis wrote:
> I've just started playing with the ULOG target in
> iptables, and I've noticed that the 'timestamp_sec'
> member of the ulog_packet_msg_t struct paseed to
> the user is always 0 for locally generated packets.

This is a well-known behaviour (see the list archives of or

This is _NOT_ considered a bug, but a feature.

> I was thinking of patching the ipt_ulog_target
> function in net/ipv4/netfilter/ipt_ULOG.c to
> check if timestamp_sec is 0 and if so, set it
> to the current time by adding code to test
> 'timestamp_sec' after it's been set. E.g;

so how would you then differentiate in userspace between

a) a skb receive timestamp
b) a timestamp created within the ULOG target (which can be very
different, think of async packets via QUEUE, etc.)

We definitely don't want to have one field in the packet that has
different semantics according from which hook it came in.

What ulogd currently does, is _always_ logging the userspace time,
disregarding the skb receive timestamp. This is way closer to the LOG
target behaviuor anyway, since in this case the time is prepended by
syslogd (which just calls gettimeofday() from userspace).

- Harald Welte <>
Programming is like sex: One mistake and you have to support it your lifetime
[unhandled content-type:application/pgp-signature]
 \ /
  Last update: 2005-03-22 13:48    [W:0.033 / U:1.776 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site