On 27.10.2013 23:20, Patrick McHardy wrote: > On Sun, Oct 27, 2013 at 08:14:19PM +0100, Jozsef Kadlecsik wrote: >> I think a single flag could be sufficient: if the timer in conntrack goes >> off and the entry is in the ESTABLISHED state and this flag is not set, >> then send a TCP keepalive packet and start the timer with a short timeout. >> If we receive the reply packet, then the long ESTABLISHED timeout value >> can be restored and the flag cleared. > Sure, I think we wouldn't even need that flag, we can just send the keepalive > and set a short timeout. If a RST is received, the connection is killed > anyway, otherwise it will be refreshed with the ESTABLISHED timeout. > > But we do need a timestamp value to pass PAWS. I believe you forgot the third scenario: neither ACK nor RST is received in reply. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
