Re: Clearing State Table

Jeff Durand wrote:
> Below is the output on 4.1.28. In this case my statemax is 7000 and
> you are right, it was at the default before and it's dumping the
> active states when it hits the defined maximum. What is TCP State
> 10? Is that TIME_WAIT? My tests in 4.1.28 now eventually have the
> states clearing but only after 4 minutes. Maybe before I wasn't
> patient enough and it's possible the only trials where I let it go for
> a long time where with older versions. If it is just in TIME_WAIT,
> then is that time setable?

It should be but it isn't. See below for a white-space crippled patch.


> The host is set to only keep it in TIME_WAIT for 60 seconds. Even so,
> is there a way to make the (limit X) option in ipf.conf only count
> against connections in the ESTABLISHED state or just not include
> TIME_WAIT? Otherwise, it's still not really counting X concurrent
> connections as much as X connections per TIME_WAIT period? In my
> case, we would be getting a lot of connections in quick succession,
> but I want to limit the number of connections being made at
> simultaneously. That make sense? Thanks for your help.

The "limit" is currently there to be counted against the total number of
sessions.
It sounds like you need a shorter time-wait timeout period...but this
may have
other implications, such as more packets not matching state and generating
more problems elsewhere...

Out of curiosity, what would you expect a per-timeout limit to do when the
number for that rule/state was reached? FIFO? Least used first out?

Darren

Index: fil.c
================================================== =================
RCS file: /devel/CVS/IP-Filter/fil.c,v
retrieving revision 2.243.2.130
diff -u -r2.243.2.130 fil.c
--- fil.c 29 Mar 2008 23:19:24 -0000 2.243.2.130
+++ fil.c 9 Apr 2008 08:01:27 -0000
@@ -6000,6 +6000,8 @@
sizeof(fr_tcpclosed), IPFT_WRDISABLED,
NULL },
{ { &fr_tcphalfclosed }, "fr_tcphalfclosed", 1, 0x7fffffff,
sizeof(fr_tcphalfclosed), IPFT_WRDISABLED,
NULL },
+ { { &fr_tcptimewait }, "fr_tcptimewait", 1, 0x7fffffff,
+ sizeof(fr_tcptimewait), IPFT_WRDISABLED,
NULL },
{ { &fr_udptimeout }, "fr_udptimeout", 1, 0x7fffffff,
sizeof(fr_udptimeout), IPFT_WRDISABLED,
NULL },
{ { &fr_udpacktimeout }, "fr_udpacktimeout", 1, 0x7fffffff,