First patch is a preparation patch that moves the trace code from netlink.c to the new trace.c file. Second patch adds the ct info to the trace output. This patch exposes the 'clash' bit to userspace. (Technically its the kernel counterpart). If you dislike this, I can send a kernel patch that removes the bit before dumping ct status bits to userspace, let me know. Change since v1: - prep patch to split to trace.c - add ct status fields to data types Florian Westphal (2): src: split monitor trace code into new trace.c src: add conntrack information to trace monitor mode Makefile.am | 1 + doc/data-types.txt | 31 +- include/linux/netfilter/nf_conntrack_common.h | 16 + include/netlink.h | 5 - include/trace.h | 8 + src/ct.c | 8 + src/monitor.c | 2 +- src/netlink.c | 332 ------------- src/trace.c | 462 ++++++++++++++++++ 9 files changed, 512 insertions(+), 353 deletions(-) create mode 100644 include/trace.h create mode 100644 src/trace.c -- 2.49.0