From this link it seems that conntrack remembers a connection for X seconds after it is closed.
Does anybody know how long that X is and if it is configurable?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
A reason conntrack should remember a TCP connection after it has been closed is the same reason TCP should remember a connection after it has been closed: RFC 793 about TCP, especially the part about TIME-WAIT that should be by default (not very clearly written) 2mn. Of course for UDP, ICMP or some other protocols, this doesn't apply but the delay is here to remember a session. This is needed for stateful firewalling or NAT.
This said, once netfilter's conntrack is loaded, most settings are available there:
(They might have been elsewere on very old kernels)
They can be displayed with for example:
# sysctl net.netfilter | grep timeout net.netfilter.nf_conntrack_dccp_timeout_closereq = 64
net.netfilter.nf_conntrack_dccp_timeout_timewait = 240 net.netfilter.nf_conntrack_frag6_timeout = 60 net.netfilter.nf_conntrack_generic_timeout = 600 net.netfilter.nf_conntrack_gre_timeout = 30 net.netfilter.nf_conntrack_gre_timeout_stream = 180 net.netfilter.nf_conntrack_icmp_timeout = 30 net.netfilter.nf_conntrack_icmpv6_timeout = 30
net.netfilter.nf_conntrack_tcp_timeout_close = 10 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 net.netfilter.nf_conntrack_tcp_timeout_established = 432000 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30 net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300 net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60 net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300 net.netfilter.nf_conntrack_udp_timeout = 30 net.netfilter.nf_conntrack_udp_timeout_stream = 120
You can use the same command (or else use
echo nnn > /proc/sys/...) to change a setting. For example to increase the TCP CLOSE state timeout to a higher delay, eg 60:
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_close=60
Some features and default settings might depend on kernel options and version. For example,
net.netfilter.nf_conntrack_udp_timeout_stream for "established" UDP traffic (considered as such when there was more than just one packet and its reply in the same flow) was decreased from 180 to 120 in recent kernels (>= 5.0 ?).
There might exist other mechanisms to change a setting for a specific connection, rather than the default global value, but I don't know how that's done exactly (the
conntrack command might help).