Hello! It seems that, when masquerading, conntrack silently drops idle connection after nf_conntrack_tcp_timeout_established seconds. This's pretty terrible, as application inside the network, if it never sends anything, will never know that connection was dropped. RFC 5382 gives us a solution to this: > A NAT can check if an endpoint for a session has crashed by sending a > TCP keep-alive packet and receiving a TCP RST packet in response. However, it I couldn't find such feature in netfilter. It would be pretty nice to have. It would be much more effective than enabling keep-alives system-wide (which is not even possible in practice). It makes sense that NAT has to manage such things, as only NAT knows the timeouts of itself. If there's a NAT along the route, it will send keep-alives (overhead, but inevitable). If there's no NATs, there will be no keep-alives. Simple. AFAIK, Cisco implements this under name Dead Connection Detection. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
