From: James Garrison <jhg@athensgroup.com>
To: netfilter@lists.netfilter.org
Subject: When is a connection ESTABLISHED in ip_conntrack?
Date: Wed, 28 Dec 2005 11:08:47 -0600 [thread overview]
Message-ID: <43B2C69F.1040902@athensgroup.com> (raw)
Partial listing of ip_conntrack:
> tcp 6 296619 ESTABLISHED src=10.56.8.1 dst=10.56.8.218 sport=39594 dport=80 packets=1 bytes=40 [UNREPLIED] src=10.56.8.218 dst=10.56.8.1 sport=80 dport=39594 packets=0 bytes=0 mark=0 use=1
> tcp 6 296616 ESTABLISHED src=10.56.8.1 dst=10.56.8.183 sport=39594 dport=80 packets=1 bytes=40 [UNREPLIED] src=10.56.8.183 dst=10.56.8.1 sport=80 dport=39594 packets=0 bytes=0 mark=0 use=1
> tcp 6 296616 ESTABLISHED src=10.56.8.1 dst=10.56.8.179 sport=39594 dport=80 packets=1 bytes=40 [UNREPLIED] src=10.56.8.179 dst=10.56.8.1 sport=80 dport=39594 packets=0 bytes=0 mark=0 use=1
These are left over from a portscan I ran 2 days ago, and there's an
entry in ip_conntrack for each and every unused IP address on our
internal subnet. Why is the connection status 'ESTABLISHED' if
there was never a response to the original SYN? This causes
ip_conntrack to use the 5-day timeout instead of 2 minutes and
clutters up the table.
This isn't really a problem, I'm asking out of curiosity and to
better understand connection tracking.
--
James Garrison Athens Group, Inc.
mailto:jhg@athensgroup.com 5608 Parkcrest Dr
http://www.athensgroup.com Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C (512) 345-0600 x150
reply other threads:[~2005-12-28 17:08 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=43B2C69F.1040902@athensgroup.com \
--to=jhg@athensgroup.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox