24 Nov, 2016

1 commit

• 486dcf43d   netfilter: fix nf_conntrack_helper documentation ... Browse Code »

  Since kernel 4.7 this defaults to off.

  Signed-off-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Florian Westphal

  2016-11-24 19:50:24 +0800  

17 Oct, 2016

1 commit

• 4f76de5f2   netfilter: conntrack: remove obsolete sysctl (nf_conntrack_events_retry_timeout) ... Browse Code »

  This entry has been removed in commit 9500507c6138.

  Fixes: 9500507c6138 ("netfilter: conntrack: remove timer from ecache extension")
  Signed-off-by: Nicolas Dichtel
  Acked-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Nicolas Dichtel

  2016-10-17 23:38:18 +0800  

24 Jun, 2016

1 commit

• 3183ab899   netfilter: conntrack: allow increasing bucket size via sysctl too ... Browse Code »

  No need to restrict this to module parameter.

  We export a copy of the real hash size -- when user alters the value we
  allocate the new table, copy entries etc before we update the real size
  to the requested one.

  This is also needed because the real size is used by concurrent readers
  and cannot be changed without synchronizing the conntrack generation
  seqcnt.

  We only allow changing this value from the initial net namespace.

  Tested using http-client-benchmark vs. httpterm with concurrent

  while true;do
  echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
  done

  Signed-off-by: Florian Westphal
  Signed-off-by: Pablo Neira Ayuso

  Florian Westphal

  2016-06-24 17:03:28 +0800  

23 Dec, 2014

1 commit

• 88eab472e   netfilter: conntrack: adjust nf_conntrack_buckets default value ... Browse Code »

  Manually bumping either nf_conntrack_buckets or nf_conntrack_max has
  become a common task as our Linux servers tend to serve more and more
  clients/applications, so let's adjust nf_conntrack_buckets this to a
  more updated value.

  Now for systems with more than 4GB of memory, nf_conntrack_buckets
  becomes 65536 instead of 16384, resulting in nf_conntrack_max=256k
  entries.

  Signed-off-by: Marcelo Ricardo Leitner
  Acked-by: Jesper Dangaard Brouer
  Signed-off-by: Pablo Neira Ayuso

  Marcelo Leitner

  2014-12-23 21:20:10 +0800  

21 Jan, 2013

1 commit

• c9f9e0e15   netfilter: doc: add nf_conntrack sysctl api documentation ... Browse Code »

  I grepped through the code and picked bits about nf_conntrack sysctl api
  and put that into one documentation file.

  [ I have mangled this patch including comments from several grammar
  improvements proposed by Neal Murphy ,
  any new grammar error is my mistake --pablo ]

  Signed-off-by: Jiri Pirko
  Signed-off-by: Pablo Neira Ayuso

  Jiri Pirko

  2013-01-21 19:50:06 +0800