path: root/doc/stateful-objects.txt
diff options
authorFlorian Westphal <>2021-10-28 17:36:06 +0200
committerFlorian Westphal <>2021-11-08 12:01:08 +0100
commit1987a7acf99458d1d0e49939b5acbb2d7711f900 (patch)
tree3926b72a4f8188c5c9f4b755205e437aea1a63f0 /doc/stateful-objects.txt
parent11e626661ded22880721ff54fbe7647166fc31bd (diff)
doc: update ct timeout section with the state names
docs are too terse and did not have the list of valid timeout states. While at it, adjust default stream timeout of udp to 120, this is the current kernel default. Signed-off-by: Florian Westphal <>
Diffstat (limited to 'doc/stateful-objects.txt')
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/stateful-objects.txt b/doc/stateful-objects.txt
index 4972969e..e3c79220 100644
--- a/doc/stateful-objects.txt
+++ b/doc/stateful-objects.txt
@@ -77,6 +77,17 @@ per ct timeout comment field |
+tcp connection state names that can have a specific timeout value are:
+'close', 'close_wait', 'established', 'fin_wait', 'last_ack', 'retrans', 'syn_recv', 'syn_sent', 'time_wait' and 'unack'.
+You can use 'sysctl -a |grep net.netfilter.nf_conntrack_tcp_timeout_' to view and change the system-wide defaults.
+'ct timeout' allows for flow-specific settings, without changing the global timeouts.
+For example, tcp port 53 could have much lower settings than other traffic.
+udp state names that can have a specific timeout value are 'replied' and 'unreplied'.
.defining and assigning ct timeout policy
table ip filter {