I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The stream is coming in on average at about 25Mb per second.

The stream comes in and works as expected with one exception. If I terminate the KVM instance and remove the IPtables rules, the stream no longer gets forwarded through the IPtables box. I expect this behavior. If I bring up another KVM instance with the same IP address, and add the same rules back into iptables, the stream does not get forwarded until I stop the stream on the sending side and leave it off for at least 30 seconds. If I start the stream after waiting 30 seconds, the traffic is again passed to the KVM instance.

I'm thinking there is some kernel parameter related to UDP timeouts that I'm unaware of. Has anyone seen behavior like this? The IPtables box is running CentOS 6.4. The KVM instance is running Ubuntu 10.04.

  • Sounds to me more like an ARP caching issue. Check the output of arp -n, but note that it may be done by a switch or some other piece of equipment not under your direct control. For a quick test, assuming you can do so, try changing the MAC address of the second KVM instance's NIC to that of the first instance after you shut down the first instance. – a CVn Sep 19 '13 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.