Struct ConnTrackConfig 

pub struct ConnTrackConfig {
    pub max_connections: usize,
    pub max_out_of_order: usize,
    pub timeout_resolution: usize,
    pub udp_inactivity_timeout: usize,
    pub tcp_inactivity_timeout: usize,
    pub tcp_reassembly_timeout: usize,
    pub tcp_establish_timeout: usize,
    /* private fields */
}

Connection tracking options.

These options can be used to tune for resource usage vs. accuracy depending on expected network characteristics.

Example

[conntrack]
    max_connections = 10_000_000
    max_out_of_order = 100
    timeout_resolution = 100
    udp_inactivity_timeout = 60_000
    tcp_inactivity_timeout = 300_000
    tcp_establish_timeout = 5000

Fields

max_connections: usize

Maximum number of connections that can be tracked simultaneously per-core. Defaults to 10_000_000.

max_out_of_order: usize

Maximum number of out-of-order packets allowed per TCP connection before it is force expired. Defaults to 100.

timeout_resolution: usize

Frequency to check for inactive streams (in milliseconds). Defaults to 1000 (1 second).

udp_inactivity_timeout: usize

A UDP connection can be inactive for up to this amount of time (in milliseconds) before it is force expired. Defaults to 60_000 (1 minute).

tcp_inactivity_timeout: usize

A TCP connection can be inactive for up to this amount of time (in milliseconds) before it is force expired. Defaults to 300_000 (5 minutes).

tcp_reassembly_timeout: usize

Override the default TCP connection inactivity timeout with this value (in milliseconds) if there are unfilled sequence number gaps.

Defaults to tcp_inactivity_timeout. This is used to prevent memory exhaustion on networks where there may be loss between the ground truth TCP connection (guaranteed retransmissions) and the monitoring vantage point (retransmissions not guaranteed).

tcp_establish_timeout: usize

Inactivity time between the first and second packet of a TCP connection before it is force expired (in milliseconds).

This approximates connections that remain inactive in either the SYN-SENT or SYN-RECEIVED state without progressing. It is used to prevent memory exhaustion due to SYN scans and SYN floods. Defaults to 5000 (5 seconds).

Trait Implementations

impl Clone for ConnTrackConfig

fn clone(&self) -> ConnTrackConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConnTrackConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ConnTrackConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ConnTrackConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.