Re: ip contrack problem, not strictly followed RFC, DoS very much possible

[Baruch Even <baruch@ev-en.org>]

Grzegorz Piotr Jaskiewicz wrote:
> If someone has argumentation for 5 days timeout, please speak out. In 
> everyday life, router, desktop, server usage 100s is enough there, and 
> makes my life easier, as many other linux admins.

1. The correct value is 5 days for the case of long idle connections, 
there are such things, and there is no reason to force such connections 
to do keepalive every 100 seconds to stay alive.

2. You can change it in your firewall in 
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established

Baruch