Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a TCP connection that can be idle for many hours. The traffic is flowing from the server to the client only. One might say it's kind of push notification.

My home router, however, tends to drop the connection silently after 20 minutes (the value of /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established). The server detects the loss once it tries to send anything (I assume it receives RST from the router itself). As client never sends anything, it never detects the loss.

RFC 5382 "NAT Behavioral Requirements for TCP" states the following:

A NAT can check if an endpoint for a session has crashed by sending a TCP keep-alive packet and receiving a TCP RST packet in response.

It makes sense. It's much more effective than sending keep-alives by the host itself (as only NAT knows its own timeout). And probably not hard to implement.

Is there any NAT solutions implementing this? It would be great if there was a way to enable this in iptables.

share|improve this question
Your router/firewall/modem has a finite set of resources (think of the memory resources used for maintaining the session/nat/state table). Now imagine that there is no NAT timeout and that there are enough idle sessions to consume all of those resources. Your ability to create any new connections/sessions to anything outside of your local network is now impossible. That's why you should implement keep-alives in your host and not try to eliminate or disable the NAT timeout setting of your router/firewall/modem. –  joeqwerty Oct 26 '13 at 15:35
@joeqwerty Oh, wait, I didn't say I want to disable NAT timeout completely. Instead, I'd like my router to check whether idle connection is abandoned or not before dropping it. –  WGH Oct 26 '13 at 15:45
1. How would the router know that the connection was abandoned? 2. You said that the connection was idle, that means that it's established but has no data flowing, which is perfectly legitimate, but it's not abandoned. –  joeqwerty Oct 26 '13 at 15:57
You want to implement something like Dead Connection Detection to determine if both sides of the connection are still valid and to reset the NAT timeout for that connection if both sides are still valid. Your home router probably doesn't have that capability. –  joeqwerty Oct 26 '13 at 16:00
@joeqwerty Yes, Dead Connection Detection looks like the thing I'm looking for. Too bad it's implemented on Cisco only. –  WGH Oct 26 '13 at 16:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.