# ip_conntrack [UNREPLIED]

## Fenixoid

Hello,

The network schema is this: local computer (192.168.1.117 or 26 or 20) with outlook express checks imap mailboxes on server (123.123.123.123). Every check is good, no errors.

Ip_conntrack on router logs this:

```
tcp      6 6195724 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=56145 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=56145 use=1 

tcp      6 5719320 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=64560 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=64560 use=1 

tcp      6 5707578 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=58440 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=58440 use=1 

tcp      6 5677876 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=56655 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=56655 use=1 

tcp      6 5671254 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=52575 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=52575 use=1 

tcp      6 5537798 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=50535 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=50535 use=1 

tcp      6 5530274 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=63795 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=63795 use=1 

tcp      6 8241538 SYN_SENT src=192.168.1.20 dst=123.123.123.123 sport=1623 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.20 sport=143 dport=1623 use=1 

tcp      6 7449398 SYN_SENT src=192.168.1.20 dst=123.123.123.123 sport=1368 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.20 sport=143 dport=1368 use=1 

tcp      6 2067532 CLOSE src=89.117.27.221 dst=195.14.176.67 sport=56062 dport=4791 [UNREPLIED] src=195.14.176.67 dst=89.117.27.221 sport=4791 dport=56062 use=1 

tcp      6 1548998 CLOSE src=85.232.142.220 dst=195.14.176.67 sport=62872 dport=3186 [UNREPLIED] src=195.14.176.67 dst=85.232.142.220 sport=3186 dport=62872 use=1 

tcp      6 1543459 SYN_SENT src=192.168.1.20 dst=123.123.123.123 sport=2388 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.20 sport=143 dport=2388 use=1 

tcp      6 352008 SYN_SENT src=192.168.1.39 dst=123.123.123.123 sport=2506 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.39 sport=143 dport=2506 use=1 

tcp      6 6744780 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=2768 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=2768 use=1 

tcp      6 6741394 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=2513 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=2513 use=1 

tcp      6 6738013 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=2258 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=2258 use=1 

tcp      6 6734844 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=2003 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=2003 use=1 

tcp      6 6731719 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=1748 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=1748 use=1 

tcp      6 6729330 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=1238 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=1238 use=1 

tcp      6 6725498 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=4808 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=4808 use=1 

tcp      6 6722084 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=55763 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=55763 use=1 

tcp      6 6718801 SYN_SENT src=192.168.1.26 dst=123.123.123.123 sport=4298 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.26 sport=143 dport=4298 use=1 

tcp      6 6717466 SYN_SENT src=192.168.1.117 dst=123.123.123.123 sport=53468 dport=143 [UNREPLIED] src=123.123.123.123 dst=192.168.1.117 sport=143 dport=53468 use=1
```

a) why "time to live" is so huge? Is this routers problem, or OE, or server's with postfix?

b) why [UNREPLIED]?

Netfilter says:

 *Quote:*   

> When a connection has seen traffic in both directions, the conntrack entry will erase the [UNREPLIED] flag, and then reset it. The entry tells us that the connection has not seen any traffic in both directions

 

How to understand this? Every connection with server is good. Is this should I worry about, will it slow down network performance?

p.s. found interesting topic here: https://forums.gentoo.org/viewtopic-p-3497273.html#3497273 but in my issue, every connection is unreplied.

----------

## Ant P.

The "[UNREPLIED]" means it's trying to connect, but the server didn't/won't acknowledge it and open a connection for whatever reason.

Those expiry times do look a lot higher than normal, but it shouldn't hurt anything.

----------

## Fenixoid

So if there's no connection (in this issue imap), how come every mailbox check comes with no errors and you can read, send anything you want via imap?

----------

## malern

 *Fenixoid wrote:*   

> why "time to live" is so huge? Is this routers problem, or OE, or server's with postfix?

 

The timeout value is how long conntrack will remember the connection for. It's not the standard IP hop ttl, and therefore has nothing to do with the other machines. You can check/change conntracks default timeouts via /proc/sys/net/netfilter/

 *Fenixoid wrote:*   

> So if there's no connection (in this issue imap), how come every mailbox check comes with no errors and you can read, send anything you want via imap?

 

There was no reply for those 21 SYN_SENT packets. It's not uncommon for a few packets to get lost on a network. The OS will normally automatically resend packets that get lost, so you probably won't even notice.

----------

