Re: ip_conntrack & timing out of connections

[David Lang]

the tcp dimeout is 60 seconds and the ip_conntrack timeout is 120 seconds.

I ran into this myself a couple days ago and have sent the info to Rusty
and to the netfilter mailing list (although only to the list this morning
so I don't know if there is a response there yet)

David Lang

On Tue, 6 Nov 2001 [e-mail] wrote:

> Date: Tue, 6 Nov 2001 12:19:47 +0100
> From: [e-mail]
> To: [e-mail]
> Subject: ip_conntrack & timing out of connections
>
> linux-2.4.13-ac5 (other versions untested) has this peculiar behaviour: If I
> "killall -STOP thttpd", I, of course, still get connection requests which
> usually time out:
>
> tcp      238      0 217.227.148.85:80       213.76.191.129:3120 CLOSE_WAIT
> tcp      162      0 217.227.148.85:80       213.76.191.129:3128 CLOSE_WAIT
> tcp      238      0 217.227.148.85:80       213.76.191.129:3136 CLOSE_WAIT
> tcp      162      0 217.227.148.85:80       213.76.191.129:3152 CLOSE_WAIT
> tcp      134      0 217.227.148.85:80       66.42.121.15:3305 CLOSE_WAIT
> tcp      162      0 217.227.148.85:80       213.76.191.129:3160 CLOSE_WAIT
> tcp      279      0 217.227.148.85:80       62.83.11.19:2742 CLOSE_WAIT
>
> however, after some time, I get many of these messages:
>
> Nov  6 02:39:55 doom kernel: ip_conntrack: table full, dropping packet.
>
> /proc/net/ip_conntrack has lots of connections like these:
>
> tcp      6 430665 ESTABLISHED src=213.76.191.129 dst=217.227.148.85 sport=3881 dport=80 src=217.227.148.85 dst=213.76.191.129 sport=80 dport=388 1 [ASSURED] use=1
>
> that is, connections to port 80. a grep dport=80 in ip_conntrack gives me
> 3768 lines, where netstat -t only shows 159 connections, so it seems that
> conntrack has a problems with time-outs (or something similar).
>
> --
>       -----==-                                             |
>       ----==-- _                                           |
>       ---==---(_)__  __ ____  __       Marc Lehmann      +--
>       --==---/ / _ \/ // /\ \/ /       [e-mail]      |e|
>       -=====/_/_//_/\_,_/ /_/\_\       XX11-RIPE         --+
>     The choice of a GNU generation                       |
>                                                          |
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [e-mail]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>