4.2. conntrack
璁板綍
鎴戜滑鍏堟潵鐪嬬湅鎬庢牱闃呰
/proc/net/ip_conntrack
閲岀殑
conntrack
璁板綍銆傝繖浜涜
褰曡〃绀虹殑鏄綋鍓嶈璺熻釜鐨勮繛鎺ャ�傚鏋滃畨瑁呬簡
ip_conntrack
妯″潡锛?/p>
cat
/proc/net/ip_conntrack
鐨勬樉绀虹被浼硷細
tcp 6 117 SYN_SENT src=192.168.1.6 dst=192.168.1.9 sport=32775 \
dport=22 [UNREPLIED] src=192.168.1.9 dst=192.168.1.6 sport=22 \
dport=32775 use=2
conntrack
妯″潡缁存姢鐨勬墍鏈変俊鎭兘鍖呭惈鍦ㄨ繖涓緥瀛愪腑浜嗭紝
閫氳繃瀹冧滑灏卞彲浠ョ煡閬撴煇
涓壒瀹氱殑杩炴帴澶勪簬浠�涔堢姸
鎬併�傞鍏堟樉绀虹殑鏄崗璁紝杩欓噷鏄?/p>
tcp
锛屾帴鐫�鏄崄杩涘埗
鐨?/p>
6
锛堣瘧鑰呮敞锛?/p>
tcp
鐨勫崗璁被鍨嬩唬鐮佹槸
6
锛夈�備箣鍚庣殑
117
鏄?/p>
杩欐潯
conntrack
璁板綍
鐨勭敓瀛樻椂闂达紝瀹冧細鏈夎寰嬪湴琚秷鑰楋紝鐩村埌鏀跺埌杩欎釜杩炴帴鐨勬洿澶氱殑鍖呫�傞偅鏃讹紝杩欎釜
鍊煎氨浼?/p>
琚涓哄綋鏃堕偅涓姸鎬佺殑缂虹渷鍊笺�傛帴涓嬫潵鐨勬槸杩欎釜杩炴帴鍦ㄥ綋鍓嶆椂闂寸偣鐨勭姸
鎬併�?/p>
涓婇潰鐨勪緥瀛愯鏄庤繖涓寘澶勫湪鐘舵�?/p>
SYN_SENT
锛?/p>
杩欎釜鍊兼槸
iptables
鏄剧ず鐨勶紝
浠?/p>
渚挎垜浠ソ鐞嗚В锛岃�屽唴閮ㄧ敤鐨勫�肩◢鏈変笉鍚屻�?/p>
SYN_SENT
璇存槑鎴戜滑姝ｅ湪瑙?/p>
瀵熺殑杩欎釜杩?/p>
鎺ュ彧鍦ㄤ竴涓柟鍚戝彂閫佷簡涓�
TCP
SYN
鍖呫�傚啀涓嬮潰鏄簮鍦板潃銆佺洰鐨勫湴鍧�銆佹簮绔彛鍜岀洰
鐨勭鍙ｃ�傚叾
涓湁涓壒娈婄殑璇?/p>
UNREPLIED
锛岃鏄庤繖涓繛鎺ヨ繕娌℃湁鏀跺埌浠讳綍鍥炲簲銆?/p>
鏈�鍚庯紝鏄笇鏈涙帴鏀剁殑搴旂瓟鍖呯殑淇℃伅锛屼粬浠?/p>
鐨勫湴鍧�鍜岀鍙ｅ拰鍓嶉潰鏄浉鍙嶇殑銆?/p>
杩炴帴璺熻釜璁板綍鐨勪俊鎭緷鎹?/p>
IP
鎵�鍖呭惈鐨勫崗璁笉鍚岃�屼笉鍚岋紝鎵�鏈夌浉搴旂殑鍊奸兘鏄湪澶?/p>
鏂囦欢
linux/include/netfilter-ipv4/ip_conntrack*.h
涓畾涔夌殑銆?/p>
IP
銆?/p>
TCP
銆?/p>
UDP
銆?/p>
ICMP
鍗?/p>
璁殑缂虹渷鍊兼槸鍦?/p>
linux/include/netfilter-ipv4/ip_conntrack.h
閲屽畾
涔夌殑銆傚叿
浣撶殑鍊煎彲浠ユ煡鐪嬬浉搴旂殑鍗忚锛屼絾鎴戜滑杩欓噷鐢ㄤ笉鍒板畠浠紝鍥犱负瀹冧滑澶ч兘
鍙湪
conntrack
鍐呴儴浣跨敤銆傞殢鐫�鐘舵�佺殑
鏀瑰彉锛岀敓瀛樻椂闂翠篃浼氭敼鍙樸�?/p>
鏈�杩?/p>
patch-o-matic
閲屾湁涓�涓柊鐨勮ˉ涓侊紝鍙互鎶婁笂闈㈡彁鍒扮殑瓒呮椂鏃堕棿涔?/p>
浣滀负绯荤粺鍙橀噺锛岃繖鏍锋垜浠氨
鑳藉鍦ㄧ郴缁熺┖闂叉椂鏀瑰彉瀹冧滑鐨勫�笺�備互鍚庯紝鎴?/p>
浠氨涓嶅繀涓轰簡鏀瑰彉杩欎簺鍊艰�岄噸缂栬瘧鍐呮牳浜嗐�?/p>
杩欎簺鍙�氳繃
/proc/sys/net/ipv4/netfilter
涓嬬殑涓�浜涚壒娈婄殑绯荤粺璋冪敤
鏉ユ敼鍙樸�?/p>
浠旂粏鐪嬬湅
/proc/sys/net/ipv4/netfilter/ip_ct_*
閲岀殑鍙橀噺鍚с�?/p>
褰撲竴涓繛鎺ュ湪涓や釜鏂瑰悜涓婇兘鏈変紶杈撴椂锛?/p>
conntrack
璁板綍灏卞垹闄?/p>
[UNREPLIED]
鏍囧織锛?
鐒跺悗閲嶇疆銆?/p>
鍦ㄦ湯灏炬湁
[ASSURED]
鐨勮褰曡鏄庝袱涓柟鍚戝凡娌℃湁娴侀噺銆?/p>
杩欐牱鐨勮褰曟槸
纭畾鐨勶紝
鍦ㄨ繛鎺ヨ窡韪〃婊℃椂锛?/p>
鏄笉浼氳鍒犻櫎鐨勶紝
娌℃湁
[ASSURED]
鐨勮褰曞氨瑕佽鍒?/p>
闄ゃ�傝繛鎺ヨ窡韪〃鑳藉绾冲灏戣褰曟槸琚竴涓彉閲忔帶鍒剁殑锛屽畠鍙敱鍐呮牳涓殑
ip-
sysctl
鍑芥暟璁剧疆銆傞粯璁ゅ�煎彇鍐充簬浣犵殑鍐呭瓨澶у皬锛?/p>
128MB
鍙互鍖呭惈
8192
鏉＄洰褰曪紝
256MB
鏄?/p>
16376
鏉°�?/p>
浣犱篃鍙互鍦?/p>
/proc/sys/net/ipv4/ip_conntrack_max
閲屾煡鐪嬨�?/p>
璁剧疆銆?/p>
