What is the difference between nf_conntrack_max and nf_conntrack_expect_max?

Question

I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.

Solution

Reference: conntrack man page

The connection tracking system maintains two different tables, one for tracking connections that are active the other for tracking connections that are /expected/ to be active. An example of an expected connection would be an FTP connection, which uses both a control connection and a data connection. When the control connection is opened, the data connection is expected to be opened.

In a single table solution, a denial-of-service could be triggered by filling the table with expectations, starving out legitimate, active connections. The separate table helps to prevent that.

In the two system setup, nf_conntrack_expect_max is the max number of entries for the expectations table, and its function is identical to that of nf_conntrack_max for the conntrack table.

Comments

[poige]

lists.netfilter.org/pipermail/netfilter-devel/2007-July/…

[hrunting]

Are you doing a lot of traffic that creates entries in the expectations table? If not, you don't even need to worry about it. If so, see how many entries typically get created, and then allow for a reasonable buffer above that.