Hi,
Currently kernel tc subsystem can do conntrack things in cat_ct. But there is a problem need to fix. For several fragment packets handle in act_ct. The tcf_ct_handle_fragments will defrag the packets to a big one. But the after action will redirect mirror to a device which maybe lead the reassembly big packet over the mtu of target device. The proposal "net/sched: act_mirred: fix fragment the packet after defrag in act_ct" http://patchwork.ozlabs.org/project/netdev/patch/1593485646-14989-1-git-send-email-we...@ucloud.cn/ is not been accepted. another proposal "net/sched: add act_ct_output support" http://patchwork.ozlabs.org/project/netdev/patch/1598335663-26503-1-git-send-email-we...@ucloud.cn/ is also not a good solution. There are some duplicate codes for this and act_mirred. Something other proposal like add the act_fragment also can't be work. The fragment will make The big packet to several ones and can't be handle in the tc pipe. And also this is not friendly for user to explicitly add action for fragment. Only do gso for the reassembly big packet is also can't fix all the case such for icmp packet. So there are some proper solution for this problem. In the Internet we can't avoid the fragment packets. BR wenxu
