I'm trying to understand the reason for/what do do about some weird entries I'm seeing in /proc/net/ip_conntrack on my (virtual) server. There appear to be a number of connections like this to/from my web server, in the ESTABLISHED state but with apparently huge times to live equating to several days (W = my server IP, X = IP of other party):
tcp 6 431997 ESTABLISHED src=X dst=W sport=52177 dport=80 packets=2 bytes=92 src=W dst=X sport=80 dport=52177 packets=1 bytes=48 [ASSURED] mark=0 secmark=0 use=1 tcp 6 22299 ESTABLISHED src=X dst=W sport=10975 dport=80 packets=2 bytes=92 src=W dst=X sport=80 dport=10975 packets=1 bytes=48 [ASSURED] mark=0 secmark=0 use=1 tcp 6 330236 ESTABLISHED src=W dst=X sport=80 dport=4555 packets=1 bytes=1420 [UNREPLIED] src=X dst=X sport=W dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 tcp 6 374668 ESTABLISHED src=W dst=X sport=80 dport=55957 packets=1 bytes=1420 [UNREPLIED] src=X dst=W sport=55957 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1
I don't think it's malicious, and may just be some quirk of ip_conntrack, since (a) taking a random sample, these connections don't appear to show up in netstat, and (b) I can see some similar entries from my own client IP. So it looks more like it's some weirdness of how ip_conntrack works.
But I was concerned that these connections may be taking up resources, and their presence appears to make ip_conntrack unreliable. Can anyone shed any light?