<story><title>My ISP Is Killing My Idle SSH Sessions</title><url>https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-ssh-sessions-yours-might-be-too/</url></story><parent_chain><item><author>inetknght</author><text>AT&amp;amp;T&amp;#x27;s home gateways have a maximum NAT translation table of 1024^H^H^H^H8192 connections. Some websites will go past that. A torrent client almost certainly will. And, now that people are working from home, there&amp;#x27;s a good chance that having multiple computers will only make that 1024 table limit even more laughable.&lt;p&gt;EDIT: okay I&amp;#x27;m wrong. It&amp;#x27;s 8192 connections, not 1024 connections. But still ridiculously low</text></item><item><author>petethepig</author><text>This happens because there&amp;#x27;s NAT (network address translation) happening somewhere.&lt;p&gt;Without NAT the only 2 parties that need to know anything about a TCP connection are client and server.&lt;p&gt;With NAT you have this problem where the router now also has to keep track of opened TCP connections.&lt;p&gt;E.g if you have a router with local IP 10.0.0.1 and external IP 30.0.0.1 and you are 10.0.0.2:55000 connecting to 230.0.0.1:443 router will have to allocate a port on it&amp;#x27;s external interface (let&amp;#x27;s say 56000) and remember it (this is the key part). So the connection will look like this:&lt;p&gt;10.0.0.2:55000 &amp;lt;-&amp;gt; NATing router 10.0.0.1 - 30.0.0.1:56000 &amp;lt;-&amp;gt;  230.0.0.1:443&lt;p&gt;When router receives packets on 30.0.0.1:56000 it has to remember to redirect them to 10.0.0.2:55000.&lt;p&gt;Memory is a limited resource so you can&amp;#x27;t just have an unlimited number of these opened connections floating around. This also makes your router vulnerable to an attack where an attacker can just open a bunch of connections and never close them, making your router eventually run out of memory.&lt;p&gt;So the classic solution to this problem is to use an LRU cache. So when your router is close to running out of space you just drop the connection that has been idling the longest.&lt;p&gt;Unfortunately, a) some routers are less sophisticated and will still drop your connections even if you do keep-alives and such, b) no matter what you do, memory is a finite resource and if the router doesn&amp;#x27;t have a lot of RAM, connections will be dropped.&lt;p&gt;¯\_(ツ)_&amp;#x2F;¯</text></item></parent_chain><comment><author>l2p</author><text>Just as a FYI&amp;#x2F;aside, it is fairly trivial to root AT&amp;amp;T home gateways, pull the certs and use your own hardware to authenticate to the network, removing their hardware off your stack entirely except for the ONT. (goodbye internet downtime due to random uncontrolled gateway &amp;quot;upgrades&amp;quot;). You just need a router capable of 802.1x client auth.&lt;p&gt;Throughput both ways actually gets really close to what I am paying for with this configuration, where as before with the default gateway (regardless of configuration), I was lucky to see 1&amp;#x2F;2 of the gigabit speeds I have been paying for.</text></comment>
<story><title>My ISP Is Killing My Idle SSH Sessions</title><url>https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-ssh-sessions-yours-might-be-too/</url></story><parent_chain><item><author>inetknght</author><text>AT&amp;amp;T&amp;#x27;s home gateways have a maximum NAT translation table of 1024^H^H^H^H8192 connections. Some websites will go past that. A torrent client almost certainly will. And, now that people are working from home, there&amp;#x27;s a good chance that having multiple computers will only make that 1024 table limit even more laughable.&lt;p&gt;EDIT: okay I&amp;#x27;m wrong. It&amp;#x27;s 8192 connections, not 1024 connections. But still ridiculously low</text></item><item><author>petethepig</author><text>This happens because there&amp;#x27;s NAT (network address translation) happening somewhere.&lt;p&gt;Without NAT the only 2 parties that need to know anything about a TCP connection are client and server.&lt;p&gt;With NAT you have this problem where the router now also has to keep track of opened TCP connections.&lt;p&gt;E.g if you have a router with local IP 10.0.0.1 and external IP 30.0.0.1 and you are 10.0.0.2:55000 connecting to 230.0.0.1:443 router will have to allocate a port on it&amp;#x27;s external interface (let&amp;#x27;s say 56000) and remember it (this is the key part). So the connection will look like this:&lt;p&gt;10.0.0.2:55000 &amp;lt;-&amp;gt; NATing router 10.0.0.1 - 30.0.0.1:56000 &amp;lt;-&amp;gt;  230.0.0.1:443&lt;p&gt;When router receives packets on 30.0.0.1:56000 it has to remember to redirect them to 10.0.0.2:55000.&lt;p&gt;Memory is a limited resource so you can&amp;#x27;t just have an unlimited number of these opened connections floating around. This also makes your router vulnerable to an attack where an attacker can just open a bunch of connections and never close them, making your router eventually run out of memory.&lt;p&gt;So the classic solution to this problem is to use an LRU cache. So when your router is close to running out of space you just drop the connection that has been idling the longest.&lt;p&gt;Unfortunately, a) some routers are less sophisticated and will still drop your connections even if you do keep-alives and such, b) no matter what you do, memory is a finite resource and if the router doesn&amp;#x27;t have a lot of RAM, connections will be dropped.&lt;p&gt;¯\_(ツ)_&amp;#x2F;¯</text></item></parent_chain><comment><author>userbinator</author><text>1k certainly seems absurdly small considering how much RAM routers likely have, the fact that they can use most of it, and the amount of data needed for a single connection table entry (2 bytes external port, 2 bytes internal port, 4 bytes internal IP adds up to 8 bytes per entry, even being very generous at 16 bytes including overhead, that&amp;#x27;s still only 16K --- on a device that likely has several MB if not more, and whose primary function is likely NAT.</text></comment>