# # General settings # General { # # Number of buckets in the caches: hash table # HashSize 8192 # # Maximum number of conntracks: # it must be >= $ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max # HashLimit 65535 # # Logfile: on (/var/log/conntrackd.log), off, or a filename # Default: off # #LogFile on # # Syslog: on, off or a facility name (daemon (default) or local0..7) # Default: off # #Syslog on # # Lockfile # LockFile /var/lock/conntrack.lock # # Unix socket configuration # UNIX { Path /tmp/sync.sock Backlog 20 } # # Netlink socket buffer size # SocketBufferSize 262142 # # Increase the socket buffer up to maximun if required # SocketBufferSizeMaxGrown 655355 # # Event filtering: This clause allows you to filter certain traffic, # There are currently three filter-sets: Protocol, Address and # State. The filter is attached to an action that can be: Accept or # Ignore. Thus, you can define the event filtering policy of the # filter-sets in positive or negative logic depending on your needs. # Filter { # # Accept only certain protocols: You may want to log the # state of flows depending on their layer 4 protocol. # Protocol Accept { TCP } # # Ignore traffic for a certain set of IP's. # Address Ignore { IPv4_address 127.0.0.1 # loopback } # # Uncomment this line below if you want to filter by flow state. # The existing TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED, # FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSED, LISTEN. # # State Accept { # ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP # } } } Stats { # # If you enable this option, the daemon writes the information about # destroyed connections to a logfile. Default is off. # Logfile: on, off, or a filename # Default file: (/var/log/conntrackd-stats.log) # LogFile on # # Enable connection logging via Syslog. Default is off. # Syslog: on, off or a facility name (daemon (default) or local0..7) # If you set the facility, use the same as in the General clause, # otherwise you'll get a warning message. # #Syslog on }