8

So say you are a user behind a NAT/router on an internal network. You begin sending UDP data to an internet-facing server. The packet hits your router, it inserts an entry to allow returning packets from that server on a specific port to be forwarded to your local machine when received.

However UDP is connectionless. How does the router know when to remove this rule when the client no longer wishes to send or receive data with this server?

Improve this question
0

2 Answers 2

Reset to default
10

A NAT router doesn't know when to remove a UDP mapping - it guesses.

The router simply ages (or times) out the entry when it hasn't been used for a period of time (usually between 5 and 60 minutes).

With TCP, there's also a similar aging/timeout to make sure that forgotten or lost sessions don't pile up, but it's much longer. Of course, normal TCP connections are properly closed, which means the NAT router can forget about it.

UDP or TCP aging is a trade-off between router resources (fast aging) and compatibility with slow low-bandwidth sessions (slow aging). Sometimes the default settings require tweaking for your workload.

Improve this answer
11
  • 1
    And many cheap routers have too little RAM and/or sloppy firmware, leading to the RAM filling up with state-information for connections that are not longer needed, but don't get cleaned up. This leads to the fairly common ritual of having to reboot the router every couple of days/weeks.
    – Tonny
    Commented Mar 16, 2018 at 12:19
  • 2
    @RonMaupin Off topic? How come? Even though the phenomenon is quite common in consumer equipment, I've also seen enough low-end "business grade" equipment guilty of it. E.g. Cisco and Siemens DSL modem/routers used to be notorious for this sort of thing.
    – Tonny
    Commented Mar 16, 2018 at 13:46
  • 2
    @RonMaupin Serious enterprise equipment of course not. But there is this entire world of "small enterprise/business" equipment that sits somewhere between consumer stuff and big enterprise stuff. Last time I looked at the FAQ this "in-between" category was still on-topic for this site.
    – Tonny
    Commented Mar 16, 2018 at 14:05
  • 2
    To offer some support for @Tonny: we had professional routers (with optional, paid support) a few years back with only 16 MB RAM and they used to fill up very quickly with DNS scans and such.
    – Zac67 ♦
    Commented Mar 16, 2018 at 18:26
  • 2
    @Zac67 Exactly, and to get support you have to get a paid-for support contract. Or the router was ISP provided and support was part of the mandatory services fee included in the ISP contract. I have been forced to be network admin for both categories. Some admins will never encounter this in the wild (I wish I was that lucky), but there are parts of the world where this sort of thing is quite common. I'm still convinced it is on-topic.
    – Tonny
    Commented Mar 17, 2018 at 11:24
0

If you install conntrack tools you can see the aging of the UDP packets. E.g.

conntrack -L
udp      17 13 src=8.7.6.5 dst=4.5.6.7 sport=5060 dport=18751 [UNREPLIED] src=4.5.6.7 dst=8.7.6.5 sport=18751 dport=5060 mark=0 use=1
udp      17 102 src=10.0.128.57 dst=8.7.6.5 sport=5060 dport=5060 src=8.7.6.5 dst=4.7.6.5 sport=5060 dport=20600 [ASSURED] mark=0 use=1

First line has TTL 13, second has 102. First line is not a stream, second is recognized as stream.

With

sysctl -a

you can see your timeout settings:

net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 120

(this are default settings)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.