Re: /proc/net/ip_conntrack trange behavior

[Dong_Wei <Dong_Wei@nj.cpsecure.com>]

Hi Yasuyuki san

> Dong_Wei wrote:
>> Thanks a lot. Yasuyuki and kaber
>>
>> I have looked the 2.6.20 kernel and found that the reason.
>>
>> When ip_conntrack try to pick up an ESTABLISHED TCP connection, this 
>> issue will happen.
> 
> 
> Exactly.
> 
>> 2.6 set an 'sysctl' value to deal with this situation
>>
>> [..]
>>
>> And we can't avoid this issue on 2.4, because no code deal with the 
>> special case.
> 
> 
> Thats correct. Is there a problem with this behaviour?

As we know, ip_conntrack has a hash_size to control the ip_conntrack 
record size. and if tcp in ESTABLISH, and ip_conntrack will keep it for 
5 DAYs.

For exsample, a NAT server can handle 8000 connections, and if sometime, 
NAT server need reboot(6000 conntrack in ESTBLISHED state now). Also we 
set ip_conntrack allowing pickup ESTABLISHED tcp connection, when NAT 
server available again, ip_conntrack will take 6000 conntracks for the 
original connections. but actully these connections are INVALID for the 
web server, because the source ip is the private IPs,such as 
192.168.0.1. and web server will not answer the client's request. But 
still the NAT server will keep the 6000 conntrack for 5 DAYs. And just 
2000 conntracks can be used for the clients. If more than 2000 client 
want connect to some websites, some ip_conntrack will be droped.

BR. DongWei