1 |
On Monday 07 January 2008, Etaoin Shrdlu wrote: |
2 |
> On Monday 7 January 2008, reader@×××××××.com wrote: |
3 |
> > Should I have compiled them directly into the kernel? |
4 |
> |
5 |
> Well, this is usually a matter of debates. For iptables stuff, I |
6 |
> generally compile everything into the kernel, but I'm sure there are |
7 |
> people who can find good reasons for using modules. So, it's ultimately |
8 |
> up to you. |
9 |
> |
10 |
> If you want iptables to be active and working all the time, then I think |
11 |
> you can compile its stuff into the kernel. It would be nice if someone |
12 |
> who uses modules also showed his reasons for keeping it as modules, so |
13 |
> you could get a better picture and make a more informed decision. |
14 |
|
15 |
# ls -la /proc/net/ip_conntrack |
16 |
-r--r----- 1 root root 0 Jan 8 08:34 /proc/net/ip_conntrack |
17 |
# cat /proc/net/ip_conntrack |
18 |
# |
19 |
# ls -la /proc/net/nf_conntrack |
20 |
-r--r----- 1 root root 0 Jan 8 08:40 /proc/net/nf_conntrack |
21 |
# cat /proc/net/nf_conntrack |
22 |
# |
23 |
|
24 |
I'm currently on the train with no internet connection. Both of the above |
25 |
files are empty. On the other hand when online they show my current |
26 |
connections. The above has been compiled into my kernel. I used to compile |
27 |
iptables stuff as modules, but only a few of them these days. The reason was |
28 |
that I did not know which I was going to use and therefore I could modprobe |
29 |
them later on as and when required. The other reason (that I never actually |
30 |
put into practice) was to patch the kernel with the latest & greatest iptable |
31 |
modules updates and modprobe accordingly. If you know what you need in terms |
32 |
of iptables kernel options go with the built-in-kernel choice; if not, |
33 |
built-as-modules could be better - unless you prefer a fat kernel for no |
34 |
reason. |
35 |
-- |
36 |
Regards, |
37 |
Mick |