Re: Clearing State Table

Jeff Durand wrote:
> Below is the output on 4.1.28.  In this case my statemax is 7000 and 
> you are right, it was at the default before and it's dumping the 
> active states when it hits the defined maximum.  What is TCP State 
> 10?  Is that TIME_WAIT?  My tests in 4.1.28 now eventually have the 
> states clearing but only after 4 minutes. Maybe before I wasn't 
> patient enough and it's possible the only trials where I let it go for 
> a long time where with older versions.  If it is just in TIME_WAIT, 
> then is that time setable?

It should be but it isn't.  See below for a white-space crippled patch.


> The host is set to only keep it in TIME_WAIT for 60 seconds.  Even so, 
> is there a way to make the (limit X) option in ipf.conf only count 
> against connections in the ESTABLISHED state or just not include 
> TIME_WAIT?  Otherwise, it's still not really counting X concurrent 
> connections as much as X connections per TIME_WAIT period?  In my 
> case, we would be getting a lot of connections in quick succession, 
> but I want to limit the number of connections being made at 
> simultaneously.  That make sense?  Thanks for your help.

The "limit" is currently there to be counted against the total number of 
sessions.
It sounds like you need a shorter time-wait timeout period...but this 
may have
other implications, such as more packets not matching state and generating
more problems elsewhere...

Out of curiosity, what would you expect a per-timeout limit to do when the
number for that rule/state was reached?  FIFO? Least used first out?

Darren

Index: fil.c
===================================================================
RCS file: /devel/CVS/IP-Filter/fil.c,v
retrieving revision 2.243.2.130
diff -u -r2.243.2.130 fil.c
--- fil.c       29 Mar 2008 23:19:24 -0000      2.243.2.130
+++ fil.c       9 Apr 2008 08:01:27 -0000
@@ -6000,6 +6000,8 @@
                sizeof(fr_tcpclosed),           IPFT_WRDISABLED,        
NULL },
        { { &fr_tcphalfclosed }, "fr_tcphalfclosed",    1,      0x7fffffff,
                sizeof(fr_tcphalfclosed),       IPFT_WRDISABLED,        
NULL },
+       { { &fr_tcptimewait }, "fr_tcptimewait",        1,      0x7fffffff,
+               sizeof(fr_tcptimewait),         IPFT_WRDISABLED,        
NULL },
        { { &fr_udptimeout },   "fr_udptimeout",        1,      0x7fffffff,
                sizeof(fr_udptimeout),          IPFT_WRDISABLED,        
NULL },
        { { &fr_udpacktimeout }, "fr_udpacktimeout",    1,      0x7fffffff,