Re: /proc/net/ip_conntrack trange behavior

[Dong_Wei <Dong_Wei@nj.cpsecure.com>]

Hi Patrick

> On Thu, 30 Aug 2007, Dong_Wei wrote:
> 
>>>> And we can't avoid this issue on 2.4, because no code deal with the 
>>>> special case.
>>>
>>>
>>> Thats correct. Is there a problem with this behaviour?
>>
>> As we know, ip_conntrack has a hash_size to control the ip_conntrack 
>> record size. and if tcp in ESTABLISH, and ip_conntrack will keep it 
>> for 5 DAYs.
>>
>> For exsample, a NAT server can handle 8000 connections, and if 
>> sometime, NAT server need reboot(6000 conntrack in ESTBLISHED state 
>> now). Also we set ip_conntrack allowing pickup ESTABLISHED tcp 
>> connection, when NAT server available again, ip_conntrack will take 
>> 6000 conntracks for the original connections. but actully these 
>> connections are INVALID for the web server, because the source ip is 
>> the private IPs,such as 192.168.0.1. and web server will not answer 
>> the client's request. But still the NAT server will keep the 6000 
>> conntrack for 5 DAYs. And just 2000 conntracks can be used for the 
>> clients. If more than 2000 client want connect to some websites, some 
>> ip_conntrack will be droped.
> 
> 
> You can drop ACK packets in state NEW to avoid connection pickup.
That's a good idea, I will make a patch for my own 2.4 Linux NAT server, 
thanks a lot :-)