I understand what
nf_conntrack_max is, but what does
nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.
Reference: conntrack man page
The connection tracking system maintains two different tables, one for tracking connections that are active the other for tracking connections that are /expected/ to be active. An example of an expected connection would be an FTP connection, which uses both a control connection and a data connection. When the control connection is opened, the data connection is expected to be opened.
In a single table solution, a denial-of-service could be triggered by filling the table with expectations, starving out legitimate, active connections. The separate table helps to prevent that.
In the two system setup,