On 04/11/18 10:45, Ed Greshko wrote: > > Yes, conntrack is the module which controls this. I believe you can modify the time > by changing the value of /proc/sys/net/netfilter/nf_conntrack_udp_timeout or maybe > nf_conntrack_udp_timeout_stream. I'm guessing the former. The little documentation > I found with a quick search was.... > > nf_conntrack_udp_timeout - INTEGER (seconds) > default 30 > > nf_conntrack_udp_timeout_stream2 - INTEGER (seconds) > default 180 > > This extended timeout will be used in case there is an UDP stream > detected. > FWIW, I did verify it to be 30 seconds the entry is held.... [root@f27k ~]# host cnn.com 1.1.1.1 > /dev/null ; sleep 29 ; conntrack -L -p udp --dport 53 | grep 1.1.1.1 conntrack v1.4.4 (conntrack-tools): 4 flow entries have been shown. udp 17 0 src=192.168.1.191 dst=1.1.1.1 sport=56648 dport=53 src=1.1.1.1 dst=192.168.1.191 sport=53 dport=56648 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 udp 17 0 src=192.168.1.191 dst=1.1.1.1 sport=36316 dport=53 src=1.1.1.1 dst=192.168.1.191 sport=53 dport=36316 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 udp 17 0 src=192.168.1.191 dst=1.1.1.1 sport=56690 dport=53 src=1.1.1.1 dst=192.168.1.191 sport=53 dport=56690 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 [root@f27k ~]# host cnn.com 1.1.1.1 > /dev/null ; sleep 30 ; conntrack -L -p udp --dport 53 | grep 1.1.1.1 conntrack v1.4.4 (conntrack-tools): 1 flow entries have been shown. -- Conjecture is just a conclusion based on incomplete information. It isn't a fact.
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
