Re: What happens to netfilter during end-of-day?
Alessandro Vesely <[email protected]> Sun, 22 Feb 2026 14:16:04 +0100
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
I just asked it on superuser: https://superuser.com/questions/1935167/netfilter-hiccup-during-cron-daily-procedure Best Ale On Thu 15/Jan/2026 12:37:49 +0100 Alessandro Vesely wrote: > On Thu 15/Jan/2026 01:52:14 +0100 Pablo Neira Ayuso wrote: >> On Wed, Jan 14, 2026 at 11:14:49AM +0100, Alessandro Vesely wrote: >>> >>> I have a netfilter daemon that makes a looping call to mnl_socket_recvfrom() >>> and quickly examines packet headers. It only stops when it's rebooted. >>> However, almost every day it receives an ENOBUFS error, just once, around 4 >>> AM, while running cron.daily. >>> >>> I haven't found any useful logs from around the same time that explain >>> what's happening. Does anyone have more information? >> >> Where is your program? It sound like it is buggy? > > > The program is part of ipqbdb[*]. The daemon I'm running is slightly different > from the released one. I copied its source here, if you'd like to have a look > at it: > https://www.tana.it/ibd-judge.c > https://www.tana.it/setsig_func.h > > The include file is for setting signals. (Another daemon in the package, the > log parser, catches USR1. Normally, no signals are sent to ibd-judge.) > > The daemon spends its time in a daemon_loop(), calling mnl_cb_run(). I launch > the daemon with arguments "q0s" and "q2dm4", which means block source IP in > queue 0, mark with value 4 destination IP in queue 2. > > Can you spot bugs? > > Best > Ale >