From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dong_Wei Subject: Re: /proc/net/ip_conntrack trange behavior Date: Thu, 30 Aug 2007 17:48:47 +0800 Message-ID: <46D6927F.1010406@nj.cpsecure.com> References: <46CE8C05.5060202@nj.cpsecure.com> <200708290914.l7T9E934019648@toshiba.co.jp> <46D5BFB5.6000206@trash.net> <46D61A10.6010405@nj.cpsecure.com> <46D66874.1050405@trash.net> Reply-To: Dong_Wei@nj.cpsecure.com Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Cc: netfilter-devel@lists.netfilter.org, Yasuyuki KOZAKAI To: Patrick McHardy Return-path: In-Reply-To: <46D66874.1050405@trash.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netfilter-devel.vger.kernel.org Hi Yasuyuki san > Dong_Wei wrote: >> Thanks a lot. Yasuyuki and kaber >> >> I have looked the 2.6.20 kernel and found that the reason. >> >> When ip_conntrack try to pick up an ESTABLISHED TCP connection, this >> issue will happen. > > > Exactly. > >> 2.6 set an 'sysctl' value to deal with this situation >> >> [..] >> >> And we can't avoid this issue on 2.4, because no code deal with the >> special case. > > > Thats correct. Is there a problem with this behaviour? As we know, ip_conntrack has a hash_size to control the ip_conntrack record size. and if tcp in ESTABLISH, and ip_conntrack will keep it for 5 DAYs. For exsample, a NAT server can handle 8000 connections, and if sometime, NAT server need reboot(6000 conntrack in ESTBLISHED state now). Also we set ip_conntrack allowing pickup ESTABLISHED tcp connection, when NAT server available again, ip_conntrack will take 6000 conntracks for the original connections. but actully these connections are INVALID for the web server, because the source ip is the private IPs,such as 192.168.0.1. and web server will not answer the client's request. But still the NAT server will keep the 6000 conntrack for 5 DAYs. And just 2000 conntracks can be used for the clients. If more than 2000 client want connect to some websites, some ip_conntrack will be droped. BR. DongWei