From mboxrd@z Thu Jan 1 00:00:00 1970 From: WGH Subject: Re: conntrack, idle TCP connection and keep-alives Date: Sun, 27 Oct 2013 23:23:17 +0400 Message-ID: <526D6825.2090505@torlan.ru> References: <526C22B8.5030102@torlan.ru> <20131027153408.GA20634@home> <20131027180129.GC27597@macbook.localnet> <20131027183825.GA17696@macbook.localnet> <20131027192019.GD32366@macbook.localnet> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: Jozsef Kadlecsik , Phil Oester , netfilter-devel@vger.kernel.org To: Patrick McHardy Return-path: Received: from forward8l.mail.yandex.net ([84.201.143.141]:52087 "EHLO forward8l.mail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753554Ab3J0TXW (ORCPT ); Sun, 27 Oct 2013 15:23:22 -0400 In-Reply-To: <20131027192019.GD32366@macbook.localnet> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On 27.10.2013 23:20, Patrick McHardy wrote: > On Sun, Oct 27, 2013 at 08:14:19PM +0100, Jozsef Kadlecsik wrote: >> I think a single flag could be sufficient: if the timer in conntrack goes >> off and the entry is in the ESTABLISHED state and this flag is not set, >> then send a TCP keepalive packet and start the timer with a short timeout. >> If we receive the reply packet, then the long ESTABLISHED timeout value >> can be restored and the flag cleared. > Sure, I think we wouldn't even need that flag, we can just send the keepalive > and set a short timeout. If a RST is received, the connection is killed > anyway, otherwise it will be refreshed with the ESTABLISHED timeout. > > But we do need a timestamp value to pass PAWS. I believe you forgot the third scenario: neither ACK nor RST is received in reply.