sonic-net / sonic-host-services

4 stars 80 forks source link

[caclmgrd]: Disable connection tracking for icmpv6 traffic #149

Closed prabhataravind closed 2 months ago

prabhataravind commented 3 months ago

icmpv6 connection tracking can cause conntrack table in kernel to grow rapidly and lead to packets being dropped, making the device unresponsive to connection requests. The fix here is to use the raw table PREROUTING chain in ip6tables to disable CT for icmpv6 packets as these really don't need to be tracked.