# l7filter: "couldn't get conntrack."

## Kenji Miyamoto

I'm trying to use the l7filter extension of IPTables to allow Bittorrent traffic:

```
# grep l7 /etc/iptables.bak 

-A POSTROUTING -o eth0 -m layer7 --l7proto bittorrent -j ACCEPT

-A PREROUTING -i eth0 -m layer7 --l7proto bittorrent -j ACCEPT

-A OUTPUT -o eth0 -m layer7 --l7proto bittorrent -j ACCEPT

-A INPUT -i eth0 -m layer7 --l7proto bittorrent -j ACCEPT
```

It looks like Bittorrent isn't working any better, though, since download speed is zero either way.  It looks like this may be related, but I have the conntrack filter enabled in my kernel config.  How can I fix this problem?

```
# dmesg | grep -i conntrack

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.

layer7: couldn't get conntrack.
```

----------

## -Craig-

Did you forget compile your Kernel afterwards?

Is conntrack enabled as module, did you modprobe it?

Obviously something is wrong with your netfilter/kernel config.

```

   /* Treat parent & all its children together as one connection, except

   for the purpose of setting conntrack->layer7.app_proto in the actual

   connection. This makes /proc/net/ip_conntrack more satisfying. */

   if(!(conntrack = nf_ct_get((struct sk_buff *)skb, &ctinfo)) ||

      !(master_conntrack=nf_ct_get((struct sk_buff *)skb,&master_ctinfo))){

      DPRINTK("layer7: couldn't get conntrack.\n");

      spin_unlock_bh(&l7_lock);

      return info->invert;

   }

```

So, does /proc/net/ip_conntrack exist?

----------

## Kenji Miyamoto

conntrack was enabled before I applied the l7filter patches as a built-in driver.

----------

## Kenji Miyamoto

Is there a solution to this problem?

----------

## Kenji Miyamoto

Even after upgrading to 2.6.23-hardened-r1, reapplying the patches, and reinstalling IPtables, I still get the "couldn't get conntrack" error.

And yes, as with the older kernel above, "/proc/net/ip_conntrack" exists, and it contains a long log of information related to connections.

----------

## Kenji Miyamoto

Has anyone had this sort of problem before?

----------

