Firewalls and filters: Connection tracking in IPv6 for Linux The growth of broadband access is driving the deployment of new services. One of the technologies developed by the EU-funded TORRENT project is a 'connection tracking' solution for Linux using the new Internet protocol standard (IPv6). Digital Economy © PhotoDisc The TORRENT project team decided that in implementing the IPv6 protocol on their platform they would enhance its packet handling functionality. The team used the Netfilter framework to do this in the Linux 2.4 kernel, a framework that allows for a firewall among other applications. The IPv6 implementation was modified to include the connection tracking functionality present in IPv4 protocols, including the method of outputting the packet flow information to the user space by using the Linux process file system. Further enhancements were also added to the IPv6 version, including the addition of byte and packet counts to the connection-tracking tables and the sending of flow states to the user space along with the counts. Additional enhancements were the logging daemon in the user space for logging information, and a state match functionality to allow for the tracking of protocol information that enables firewall filtering. As well as the filtering firewall, these protocol modifications and additions allow for several other features to be implemented in IPv6 on the TORRENT framework. The system can examine and modify packets in order to guide routing and queuing, for example, and can also communicate packet flow and traffic volume to the user space.
