# Software flow offloading and conntrack timeouts **URL:** \ **Category:** For Developers\ **Created:** [September 19, 2020, 4:43am UTC](https://forum.openwrt.org/t/software-flow-offloading-and-conntrack-timeouts/74588 "2020-09-19T04:43:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![patrakov](https://forum.openwrt.org/user_avatar/forum.openwrt.org/patrakov/32/10555_2.png) [@patrakov](https://forum.openwrt.org/u/patrakov)\ **Post date:** [September 19, 2020, 4:43am UTC](https://forum.openwrt.org/t/software-flow-offloading-and-conntrack-timeouts/74588/1 "2020-09-19T04:43:35Z")
I have an OpenWRT router (the issue happens both with TP-Link archer C7 v2 and with Netgear R7800). Flow offloading is enabled, but (for censorship circumvention reasons, so that I can analyze the first few packets for known strings generated by censorware) in a custom way: ``` iptables -A FORWARD -m comment --comment "!fw3: Traffic offloading (modified)" -m conntrack --ctstate RELATED,ESTABLISHED -m connbytes --connbytes 8 --connbytes-mode packets --connbytes-dir reply -j FLOWOFFLOAD ``` I have three networks: the usual WAN and LAN, and also LAB, which is just a separate VLAN without DHCP on the LAN side of the switch. There is no NAT between LAN and LAB, but there is a stateful firewall: hosts in the LAN can initiate connections to the LAB, but not the other way round. I have noticed a strange thing: ssh connections from LAN to LAB break more often than I expect. The default /etc/sysctl.d/11-nf-conntrack.conf file has this line: ``` net.netfilter.nf_conntrack_tcp_timeout_established=7440 ``` And indeed, the initial content of /proc/net/nf\_conntrack shows something like this: ``` ipv4 2 tcp 6 7438 ESTABLISHED src=192.168.0.235 dst=10.0.0.2 sport=55142 dport=22 packets=3 bytes=164 src=10.0.0.2 dst=192.168.0.235 sport=22 dport=55142 packets=2 bytes=153 [ASSURED] mark=16128 zone=0 use=2 ``` Then the [ASSURED] part changes into [OFFLOAD], and the timer disappears. ``` ipv4 2 tcp 6 src=192.168.0.235 dst=10.0.0.2 sport=55142 dport=22 packets=30 bytes=1920 src=10.0.0.2 dst=192.168.0.235 sport=22 dport=55142 packets=20 bytes=2560 [OFFLOAD] mark=16128 zone=0 use=3 ``` After some time (~30 sec), the [OFFLOAD] line changes back into [ASSURED], but the count-down timer starts at 120. ``` ipv4 2 tcp 6 114 ESTABLISHED src=192.168.0.235 dst=10.0.0.2 sport=55142 dport=22 packets=48 bytes=3072 src=10.0.0.2 dst=192.168.0.235 sport=22 dport=55142 packets=32 bytes=4096 [ASSURED] mark=16128 zone=0 use=2 ``` Then, after 2 minutes, the conntrack entry disappears. I would expect it to disappear after ~2 hours of inactivity, not 2 minutes. Can anyone else confirm this behavior? Is it a bug? Why doesn't the count-down use the nf\_conntrack\_tcp\_timeout\_established value when it exits the [OFFLOAD] status? Where can I change the timeout that is used after the connection exits the [OFFLOAD] status? ---
**Author:** ![riatre](https://forum.openwrt.org/user_avatar/forum.openwrt.org/riatre/32/30810_2.png) [@riatre](https://forum.openwrt.org/u/riatre)\ **Post date:** [January 24, 2021, 3:37pm UTC](https://forum.openwrt.org/t/software-flow-offloading-and-conntrack-timeouts/74588/2 "2021-01-24T15:37:56Z")
> Can anyone else confirm this behavior? Yes, flow tables evict inactive flows after 30 seconds, conntrack will then pickup the connection if there are any traffic in 120 seconds. > Is it a bug? This is quite unfortunate, but seems it is indeed deliberate, and not configurable: [https://patchwork.ozlabs.org/project/netdev/patch/20180720130906.27687-3-pablo@netfilter.org/](https://patchwork.ozlabs.org/project/netdev/patch/20180720130906.27687-3-pablo@netfilter.org/) ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [February 3, 2021, 3:37pm UTC](https://forum.openwrt.org/t/software-flow-offloading-and-conntrack-timeouts/74588/3 "2021-02-03T15:37:58Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.