[IDEA] Dynamic priority process

[mk01]

(13th Aug, 2013 01:35 AM)belese Wrote:  after search, i've read it's not possible,
the work around i've seen (and if i understand you, is what you explain),
is to use LOG in iptables, and the daemon read log file, and when specific log is writed, react on this.
this is what you explain, right?

fo netfilter, no sure iv'e understand, only thing i need is tcp (maybe udp) socket state changed.

yes, LOG to rsyslog and rsyslog to socket. no polling. LOG is writing to syslog via 514/tcp/udp so if you don't use it, you can bind directly on 514 and just wait - never tried parsing 514/syslog tcp communication.

but for this CONNECT / LISTEN , just create rule to dup packet. one will go to original destination, second to you bind port

iptables -A PREROUTING -t mangle -j TEE -m state --state ESTABLISHED -p tcp --dport XX --gateway 127.0.0.1

(will copy & forward packet to 127.0.0.1, which was part of established connection to your box on port XX)

based on actual rate / bandwidth you could change the priority in more steps... somehow I though you want this.

---

but when I'm thinking, the easy effective - whole daemon

Code:

conntrack -E -e NEW,DESTROY -p tcp --dport 22 | \
while read line; do  
   case $line in
     *NEW*)
        initctl emit -n NEW_CONNECTION_priority_high
        ;;
     *DESTROY*)
        initctl emit -n CLOSED_CONNECTION_EXPIRED_priority_low
        ;;
    esac
done