Pablo Neira Ayuso
pablo at netfilter.org
Thu Nov 9 15:51:43 CET 2006
I've cc'ed this email to netfilter users mailling list since I think
that this question is not so related with the development.
> I wanted to know if it is possible to change the default
> timeout for conntrack entries. And if a modification of these
> timeout will not have border effects on other system features.
You can change them via:
- conntrack tool/libnetfilter_conntrack library
What do you mean with border effects? Of course the behaviour will
change, think about halted TCP connections for whatever reason, if the
timeout is higher then they will get stuck longer in the conntrack table.
> I noticed for example that the UDP timeout is set to 30
> seconds if the connection is not assured and 180 in the other
> The problem i am facing is that i want to detect the end of a
> connection as soon as possible and a delay of 1 or 2 minutes
> is clearly not acceptable.
> I found some conf files in /proc/sys/net/netfilter, however
> not all the timeouts are represented
Which timers are you referring to?
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris
More information about the netfilter