Conntrack timeout

Conntrack timeout

[mael.boutin]

Hi,

I wanted to know if it is possible to change the default
timeout for conntrack entries. And if a modification of these
timeout will not have border effects on other system features.

I noticed for example that the UDP timeout is set to 30
seconds if the connection is not assured and 180 in the other
case.

The problem i am facing is that i want to detect the end of a
connection as soon as possible and a delay of 1 or 2 minutes
is clearly not acceptable.

I found some conf files in /proc/sys/net/netfilter, however
not all the timeouts are represented

Thanks for your help,

Maël.

Accédez au courrier électronique de La Poste
sur www.laposte.net ou sur 3615 LAPOSTENET (0,34€ TTC /mn)
1 Giga de stockage gratuit – Antispam et antivirus intégrés

Re: Conntrack timeout

[Pablo Neira Ayuso]

Hi,

I've cc'ed this email to netfilter users mailling list since I think 
that this question is not so related with the development.

mael.boutin wrote:
> I wanted to know if it is possible to change the default
> timeout for conntrack entries. And if a modification of these
> timeout will not have border effects on other system features.

You can change them via:
- /proc/sys/net/ipv4/netfilter/ip_conntrack_[tcp|udp]_*
- conntrack tool/libnetfilter_conntrack library

What do you mean with border effects? Of course the behaviour will 
change, think about halted TCP connections for whatever reason, if the 
timeout is higher then they will get stuck longer in the conntrack table.

> I noticed for example that the UDP timeout is set to 30
> seconds if the connection is not assured and 180 in the other
> case.
> 
> The problem i am facing is that i want to detect the end of a
> connection as soon as possible and a delay of 1 or 2 minutes
> is clearly not acceptable.
> 
> I found some conf files in /proc/sys/net/netfilter, however
> not all the timeouts are represented

Which timers are you referring to?

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Re: Conntrack timeout

[Pablo Neira Ayuso]

mael.boutin@laposte.net wrote:
>> You can change them via:
>> - /proc/sys/net/ipv4/netfilter/ip_conntrack_[tcp|udp]_*
>> - conntrack tool/libnetfilter_conntrack library
> 
> In fact i m tracking ipv6 connections. Therefore the first one
> is not available (i m using nf_conntrack)

check /proc/sys/net/netfilter/nf_conntrack_*

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris