conntrack question - what happens after timeout?
philipc at snapgear.com
Wed Nov 23 06:55:34 CET 2005
On 11/21/2005 07:37 PM, Daniel Sievers wrote:
> since recently we have had some problems with the conntrack table
> growing too large and thus I experimented with lowering
> from 5 days to a couple of hours.
Perhaps increasing your memory to match the workload is a better solution.
> One thing I am still curious about though:
> What happens after established connections timeout if packets arrive
> which still belong to that connection? Do they get dropped automatically
> by netfilter or do I have to set up a rule to accomplish this?
The packets will not match any existing conntrack, and so a new
conntrack will be created. If you want to drop these packets,
then you will need a rule such as:
iptables -A FORWARD -p tcp ! --syn -m conntrack --cstate NEW -j DROP
Note that a conntrack state of NEW does not imply that the SYN flag is set.
> In other words: Is the conntrack code merely about managing a table with
> connection states that gets used e.g. in the NAT code and can be used to
> query the state of connections in iptables rules or does it perform
> stateful inspection itself and (based on that) packet dropping etc. too?
The conntrack code determines whether the packet belongs to a
NEW or ESTABLISHED conntrack etc. Whether packets are dropped based
on that state is entirely up to the iptables rules.
More information about the netfilter