1

From this link it seems that conntrack remembers a connection for X seconds after it is closed.

Does anybody know how long that X is and if it is configurable?

0

A reason conntrack should remember a TCP connection after it has been closed is the same reason TCP should remember a connection after it has been closed: RFC 793 about TCP, especially the part about TIME-WAIT that should be by default (not very clearly written) 2mn. Of course for UDP, ICMP or some other protocols, this doesn't apply but the delay is here to remember a session. This is needed for stateful firewalling or NAT.

This said, once netfilter's conntrack is loaded, most settings are available there:

/proc/sys/net/netfilter/

(They might have been elsewere on very old kernels)

They can be displayed with for example:

# sysctl net.netfilter | grep timeout
net.netfilter.nf_conntrack_dccp_timeout_closereq = 64

[...]

net.netfilter.nf_conntrack_dccp_timeout_timewait = 240
net.netfilter.nf_conntrack_frag6_timeout = 60
net.netfilter.nf_conntrack_generic_timeout = 600
net.netfilter.nf_conntrack_gre_timeout = 30
net.netfilter.nf_conntrack_gre_timeout_stream = 180
net.netfilter.nf_conntrack_icmp_timeout = 30
net.netfilter.nf_conntrack_icmpv6_timeout = 30

[...]

net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 432000
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 120

You can use the same command (or else use echo nnn > /proc/sys/...) to change a setting. For example to increase the TCP CLOSE state timeout to a higher delay, eg 60:

sysctl -w net.netfilter.nf_conntrack_tcp_timeout_close=60

Some features and default settings might depend on kernel options and version. For example, net.netfilter.nf_conntrack_udp_timeout_stream for "established" UDP traffic (considered as such when there was more than just one packet and its reply in the same flow) was decreased from 180 to 120 in recent kernels (>= 5.0 ?).

There might exist other mechanisms to change a setting for a specific connection, rather than the default global value, but I don't know how that's done exactly (the conntrack command might help).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.