From: Vladimir Smelhaus <vl.sm@email.cz>
To: netfilter@vger.kernel.org
Subject: Flowtables ignore timeout settings in recent kernels
Date: Sun, 15 Oct 2023 21:56:14 +0200 [thread overview]
Message-ID: <ughg4v$130b$1@ciao.gmane.io> (raw)
[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]
Netfilter ignores the timeout settings for a flowtable
# sysctl -a -r flowtable
net.netfilter.nf_flowtable_tcp_timeout = 30
net.netfilter.nf_flowtable_udp_timeout = 30
Situation. A long udp connection (tunnel) with some data flowing through a router. The connection is sent to a flowtable on the router. It's a few packets per second, more here and there, a pause here and there, and so on over and over. The pauses are
minimal and are also limited by the tunnel settings to be no longer than 25 seconds. Everything is satisfying to make the connection last continuously in the flowtable and not reappear in forward. However, the connection keeps dropping out of the
flowtable. It stays in the flowtable (offloaded) for a second at most and then it is kicked out, back to forward.
In an attached test script you can see counters that should be zero but are not. If I watch the normal packet flow on a particular router, I can see packets in the conntrack table that should be OFFLOAD as ASSURED.
Tested in kernel 6.5.6. In an old(er) kernel 5.10 it works as expected.
Regards
Vladimir Smelhaus
[-- Attachment #2: test_flowtable.sh --]
[-- Type: application/x-shellscript, Size: 10791 bytes --]
next reply other threads:[~2023-10-15 20:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-15 19:56 Vladimir Smelhaus [this message]
2023-10-16 0:20 ` Flowtables ignore timeout settings in recent kernels Bagas Sanjaya
2023-10-24 20:11 ` Pablo Neira Ayuso
2023-10-25 0:56 ` Bagas Sanjaya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='ughg4v$130b$1@ciao.gmane.io' \
--to=vl.sm@email.cz \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).