From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: Conntrack timeout Date: Thu, 09 Nov 2006 15:51:43 +0100 Message-ID: <4553407F.1060707@netfilter.org> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: "mael.boutin" Cc: netfilter-devel , netfilter@lists.netfilter.org Hi, I've cc'ed this email to netfilter users mailling list since I think that this question is not so related with the development. mael.boutin wrote: > I wanted to know if it is possible to change the default > timeout for conntrack entries. And if a modification of these > timeout will not have border effects on other system features. You can change them via: - /proc/sys/net/ipv4/netfilter/ip_conntrack_[tcp|udp]_* - conntrack tool/libnetfilter_conntrack library What do you mean with border effects? Of course the behaviour will change, think about halted TCP connections for whatever reason, if the timeout is higher then they will get stuck longer in the conntrack table. > I noticed for example that the UDP timeout is set to 30 > seconds if the connection is not assured and 180 in the other > case. > > The problem i am facing is that i want to detect the end of a > connection as soon as possible and a delay of 1 or 2 minutes > is clearly not acceptable. > > I found some conf files in /proc/sys/net/netfilter, however > not all the timeouts are represented Which timers are you referring to? -- The dawn of the fourth age of Linux firewalling is coming; a time of great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris