Hi,
I've cc'ed this email to netfilter users mailling list since I think
that this question is not so related with the development.
mael.boutin wrote:
I wanted to know if it is possible to change the default
timeout for conntrack entries. And if a modification of these
timeout will not have border effects on other system features.
You can change them via:
- /proc/sys/net/ipv4/netfilter/ip_conntrack_[tcp|udp]_*
- conntrack tool/libnetfilter_conntrack library
What do you mean with border effects? Of course the behaviour will
change, think about halted TCP connections for whatever reason, if the
timeout is higher then they will get stuck longer in the conntrack table.
I noticed for example that the UDP timeout is set to 30
seconds if the connection is not assured and 180 in the other
case.
The problem i am facing is that i want to detect the end of a
connection as soon as possible and a delay of 1 or 2 minutes
is clearly not acceptable.
I found some conf files in /proc/sys/net/netfilter, however
not all the timeouts are represented
Which timers are you referring to?
--
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris
