-
Notifications
You must be signed in to change notification settings - Fork 226
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove conntrack lookups #67
Conversation
I'm 👍 to deprecating support for pre-4.4 kernels, and generally getting to a place where conntrack isn't a requirement would be great. Did you end up managing to track down the few increments you saw in #50 (comment) ?
Mostly a curiosity though, it seems pretty clear that the |
I've not managed to verify it, but I think they are due to a buggy
conntrack set up on our side. We have a fair amount of NOTRACK for
historical / performance reasons, and I think that makes CT miss outbound
RST sometimes. This way we get into the state where the socket lookup
fails, but CT believes the tuple is valid.
After finding that the hit % is so low plus a better understanding of the
TCP stack I stopped investigating TBH :)
|
I found the same conntrack counters in our setup, so used a bcc+scapy script to sniff the packets that were getting picked up by conntrack:
The corresponding full tcpdump:
It seems at the point of the |
Very interesting! The From some digging, this happens in At this point, If I understand correctly there is not much to do here, besides documenting it in the code. |
Updated the branch with a comment based on our investigation. |
When a SYN packet is received, Linux creates a so called request socket. This is smaller than a full socket, and helps conserve resources. Request sockets (aka reqsk) always have sk_state equal to TCP_NEW_SYN_RECV, and are part of the inet hash tables. This means they are returned by a call to inet_lookup_established and friends. This is true as of v4.4, and was introduced by commit torvalds/linux@079096f Fixes #50
v4.4 changed the way TCP connection requests are handled, which means that conntrack lookups are not required anymore. Make sure we are building against at least 4.4, and remove obsolete compile time guards.
Ping @theojulienne |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍 Thanks for adding the updated comment - I think this makes sense and is worth it to not rely on / require conntrack.
When a SYN packet is received, Linux creates a so called request socket.
This is smaller than a full socket, and helps conserve resources. Request
sockets (aka reqsk) always have sk_state equal to TCP_NEW_SYN_RECV, and
are part of the inet hash tables. This means they are returned by a call
to inet_lookup_established and friends.
This is true as of v4.4, and was introduced by commit torvalds/linux@079096f
Fixes #50