mk-fg / conntrack-logger Goto Github PK

While testing on Ubuntu enabled conntrack with accounting module.
I see the event using conntrack -E with bytes and packets field.
However, when using conntrack logger, such information is not present in the event xml (all flags enabled in the generator)
Any possible hint?

Best regards,
Zied

./nfct_logger.py -p tcp
python: api.c:306: nfct_callback_register2: Assertion `h != ((void *)0)' failed.
Aborted (core dumped)

That's a permission issue. running with sudo solved the issue.
I suggest testing for the appropriate permissions and not crashing :)

I see intermittent parse failures when I run this on Ubuntu 16.04, such as the following:

ERROR:root:Failed to parse event data: <flow type="new"><meta direction="original"><layer3 protonum="2" protoname="ipv4"><src>192.168.0.2</src><dst>1.75.7.178</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>33367</sport><dport>80</dport></layer4></meta><meta direction="reply"><layer3 protonum="2" protoname="ipv4"><src>1.75.7.178</src><dst>1.2.4.5</dst></layer3><layer4 protonum="6" protoname="tcp"><sport>80</sport><dport>33367</dport></layer4></meta><meta direction="independent"><state>SYN_SENT</state><timeout>120</timeout><id>501034516</id><unreplied/></meta><when><hour>21</hour><min>39</min><sec>50</sec><wday>3</wday><day>11</day><month>7</month><year>2017</year></when></flow>

I haven't had a chance to triage further; will update this issue if I do.