diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2008-08-07 14:53:12 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2008-08-07 14:53:12 +0200 |
| commit | 6cb33c62c8007593d8a85aa202fa173043877135 (patch) | |
| tree | c3fbcdbffb912d1abcff20846773f0663195c5ab /doc/sync/alarm | |
| parent | a4f4647b4b7f32f2d1caab98544802c8cdd7b4d6 (diff) | |
| download | conntrack-tools-6cb33c62c8007593d8a85aa202fa173043877135.tar.gz conntrack-tools-6cb33c62c8007593d8a85aa202fa173043877135.zip | |
cache iterators: rework cache_reset_timers
This patch adds the clause PurgeTimeout that sets the new timer
when conntrackd -t is called. This command is particularly useful
when the sysadmin triggers hand-overs between several nodes without
rebooting as it reduces the timers of the remaining entries in
the kernel. Thus, avoiding clashes between new and old entries that
may trigger INVALID packets.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc/sync/alarm')
| -rw-r--r-- | doc/sync/alarm/conntrackd.conf | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/sync/alarm/conntrackd.conf b/doc/sync/alarm/conntrackd.conf index a65a378..d6f7a2a 100644 --- a/doc/sync/alarm/conntrackd.conf +++ b/doc/sync/alarm/conntrackd.conf @@ -23,6 +23,17 @@ Sync { # takeover process is completed. # CommitTimeout 180 + + # + # If the firewall replica goes from primary to backup, + # the conntrackd -t command is invoked in the script. + # This command resets the timers of the conntracks that + # live in the kernel to this new value. This is useful + # to purge the connection tracking table of zombie entries + # and avoid clashes with old entries if you trigger + # several consecutive hand-overs. + # + PurgeTimeout 15 } # |