/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Good morning, David,
On Wed, 22 Dec 1999, David A. Ranch wrote:
> I've been playing around with VNC here to remote control a
> Windows box. It works pretty well but I once lost
> communications to it. I tried to restore communications
> to it but that failed.
>
> I then ran a "/sbin/ipfwadm -l -M" and saw (3) MASQed connections
> from the Windows box back to the VNC viewer (one for the
> original link and two others for re-connection attempts). I
> think that if I could EXPIRE the MASQ entries, things would
> work.
>
> I tried resetting the MASQ timers via IPFWADM but that seems to
> only work on NEW connections and not the existing ones. So I
> thought I might be able to change this via /proc much the way
> you can turn on IP forwarding. Unfortunately, the ip_masquerade
> file is READ ONLY.
>
> --
> [root@trinity2 net]# ls -la /proc/net
> .
> .
> -rw-r--r-- 1 root root 0 Dec 21 13:06 ip_forward
> -rw-r--r-- 1 root root 0 Dec 21 13:06 ip_input
> -r--r--r-- 1 root root 0 Dec 21 13:06 ip_masq_app
> -r--r--r-- 1 root root 0 Dec 21 11:51 ip_masquerade
> .
> .
> --
>
> Does anyone have any ideas of how to enable a manual reset or KILL of
> all Masq table entries?
I'd bet a dollar that you already knew this, but for those on the
list that are not familiar with adjusting timeouts, the current code does
not immediately change the timeout on all connnections when one uses the
ipfwadm change timeout command. The timeouts are only reset when a new
packet on that connection comes through the firewall.
In David's case, where there will never be any more packets on
those connections, he can change the default timeout with the ipfwadm
command all he'd like and those connections will never change; the timeout
in place at the last active packet will continue to be in place, working
its way slowly down to 0 seconds.
The obvious answer of "vi /proc/kcore" to adjust the timeouts
tends to be too tricky for daily use. ;-)
And no, don't try this at home.
Cheers,
- Bill
---------------------------------------------------------------------------
"Eagles may soar, high and proud, but weasels don't get sucked
into jet engines."
(Courtesy of Mike Andrews <[EMAIL PROTECTED]>)
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]). Mason, Buildkernel, named2hosts,
and ipfwadm2ipchains are at: http://www.pobox.com/~wstearns/
--------------------------------------------------------------------------
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
