commit 294304e4c522d797b7ea8200ab74354843fa68e9
author Florian Westphal <fw@strlen.de> Tue Dec 18 00:05:29 2018 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> Fri Dec 21 00:48:46 2018 +0100
tree 14c5ed235dc6980f3b892f6717f0243564bf4b36
parent d535c8a69c1924e70186d80be0a9cecaf475f166

netfilter: conntrack: udp: set stream timeout to 2 minutes

We have no explicit signal when a UDP stream has terminated, peers just
stop sending.

For suspected stream connections a timeout of two minutes is sane to keep
NAT mapping alive a while longer.

It matches tcp conntracks 'timewait' default timeout value.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Documentation/networking/nf_conntrack-sysctl.txt

diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt
index 1669dc2..e69b2e6 100644
--- a/Documentation/networking/nf_conntrack-sysctl.txt
+++ b/Documentation/networking/nf_conntrack-sysctl.txt
@@ -157,7 +157,7 @@
 	default 30
 
 nf_conntrack_udp_timeout_stream - INTEGER (seconds)
-	default 180
+	default 120
 
 	This extended timeout will be used in case there is an UDP stream
 	detected.