conntrack question - what happens after timeout?

[Philip Craig]

On 11/21/2005 07:37 PM, Daniel Sievers wrote:
> since recently we have had some problems with the conntrack table
> growing too large and thus I experimented with lowering
> /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established
> from 5 days to a couple of hours.

Perhaps increasing your memory to match the workload is a better solution.

> One thing I am still curious about though:
> What happens after established connections timeout if packets arrive
> which still belong to that connection? Do they get dropped automatically
> by netfilter or do I have to set up a rule to accomplish this?

The packets will not match any existing conntrack, and so a new
conntrack will be created.  If you want to drop these packets,
then you will need a rule such as:

iptables -A FORWARD -p tcp ! --syn -m conntrack --cstate NEW -j DROP

Note that a conntrack state of NEW does not imply that the SYN flag is set.

> In other words: Is the conntrack code merely about managing a table with
> connection states that gets used e.g. in the NAT code and can be used to
> query the state of connections in iptables rules or does it perform
> stateful inspection itself and (based on that) packet dropping etc. too?

The conntrack code determines whether the packet belongs to a
NEW or ESTABLISHED conntrack etc.  Whether packets are dropped based
on that state is entirely up to the iptables rules.