Kernel —— Netfilter

###References
##Pablo Neira Ayuso -- main developer of netfilter.
Netfilter’s connection tracking system

##Linux kernel networking implemention and theory
Chapter 9 Netfilter


###Why netfilter existed?
It was started in 1998 by Rusty Russell.
The netfilter subsystem provides a framework that enables registering callbacks in various points (netfilter hooks) in the packet
traversal in the network stack and performing various operations on packets, such as changing addresses or ports,
dropping packets, logging, and more.

###How can netfilter do?
Packet selection (iptables)
Packet filtering
NAT
Packet mangling (modifying the contents of packet headers before or after routing)
Connection tracking
Gathering network statistics(origin hwf-sqos is based on this functionalities.)

###What consist netfilter?
In enssience, Nefilter is just 5 hooks frameworks.
More details:

          --->PRE------>[ROUTE]------>FWD---------->POST------>
              Conntrack    |       Mangle  ^    Mangle
              Mangle         |       Filter      |    NAT (Src)
              NAT (Dst)     |                     |    Conntrack
              (QDisc)         |               [ROUTE]
                                   v                   |
                             IN Filter       OUT Conntrack
                                   |  Conntrack ^  Mangle
                                   |  Mangle      |  NAT (Dst)
                                   v                   |  Filter

###What's new in netfilter? xtables2 nftables 

 We try to explain the whole things about linux kernel netfilter module.

conntrack  在netfilter这个大盒子，是作为基础存在的。

NAT 依赖 conntrack

nf_conntrack_in prerouting
nf注册
nf_register_hooks
nf_register_hook

nf conntrack init
module_init(nf_conntrack_L3proto_init)