Hi, when I do a tcpdump of these packets and then immediately look into the conntrack table I can find no associated entries there suggesting that the entries have indeed been removed right away without any sort of timeout. Regards, Dennis On 20.01.2017 16:23, Llorente Santos Jesus wrote: > Hi, > I wouldn't think that is the problem...as far as I know conntrack sets specific timeouts on the connections to match with the actual conntrack state. > You can see these via > sysctl -a | grep net.netfilter.nf_conntrack_ > > Best, > Jesus > > -----Original Message----- > From: Dennis Jacobfeuerborn [mailto:dennisml@xxxxxxxxxxxx] > Sent: 20 January 2017 12:37 > To: Mark Coetser <mark@xxxxxxxxxxxx>; Llorente Santos Jesus <jesus.llorente.santos@xxxxxxxx>; netfilter@xxxxxxxxxxxxxxx > Subject: Re: intermittent nat issue > > On 20.01.2017 10:47, Mark Coetser wrote: >> Hi Llorente >> >> I did run conntrack -F to check that but still had the unnatted >> packets traversing the interface. >> > > Hi, I'm seeing this as well on our systems. One thing I notice is that all packets either the RST of FIN flag set. Could this be some sort of race condition where Conntrack removes the connection from the table because of the flags and as a result the final packet will not get masqueraded/nat'ed? > > Regards, > Dennis > > N�����r��y���b�X��ǧv�^�){.n�+���z���{ay� ʇڙ�,j��f���h���z� �w��� ���j:+v���w�j�m��������zZ+�����ݢj"��!tml= > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
