vyos conntrack timeout time value


#1

Recentely, I used vyos as my lab test, inside located one linux box A , and outside I had one monitor box B.

I used B to monitor check A’s tcp port 22 and A’s service which located on tcp port 10066 if they were open.

But, after I used the command “show conntrack table ipv4 | count”, the number was 1,000 high.

Split the command output, I found there were lots of conn which about tcp port 10066

[code]TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
TW - TIME WAIT, CL - CLOSE, LI - LISTEN

CONN ID Source Destination Protocol TIMEOUT
1030982176 1.1.1.1:51546 2.2.2.1:10066 tcp [6] ES 427177
886354880 1.1.1.1:37239 2.2.2.1:10066 tcp [6] ES 399787
992023328 1.1.1.1:36151 2.2.2.1:10066 tcp [6] ES 408034
973620928 1.1.1.1:54919 2.2.2.1:10066 tcp [6] ES 431600 [/code]

The last column was high, if that 427177 represent seconds, it was 5days long ago.

So, Any Idea to decrease the timeout value, If I can’t find someway to decrease the timeout > decrease the conntrack table, the memory that vyos used will high and vyos would not be stable.


#2

Your right in that the conntrack timeout is in second and that it’s 5days, however, it is the remaining timeout.

I.E. this entry will timeout in 427177 seconds. That means it is 432000-427117=4823 seconds (or 1h 20min 23 seconds) old.

I’m not sure this is something to worry about unless you have a very-low memory VyOs box.

You can refer to this article about conntrack memory usage : https://johnleach.co.uk/words/2009/06/17/netfilter-conntrack-memory-usage/


#3

Thanks budy, verfy useful material.

And I checkout the box sysctl parameter, find

root@vr-jkzx:/proc/sys/net/netfilter# cat nf_conntrack_tcp_timeout_established 432000

So, we can reduce the timeout value at the system env.

Also, I made a monitor using openfalcon, and the memory was reduce on timeline.

I will checkout the conn and memory status for a little long time.

TOBECONTINE