On Fri, Mar 13, 2026 at 2:15 AM Pablo Neira Ayuso [off-list ref] wrote:

On Fri, Mar 13, 2026 at 03:09:19AM +0100, Florian Westphal wrote:

quoted

Prasanna S Panchamukhi [off-list ref] wrote:

quoted

The conntrack garbage collection worker uses an adaptive algorithm that
adjusts the scan interval based on the average timeout of tracked
entries.  The upper bound of this interval is hardcoded as
GC_SCAN_INTERVAL_MAX (60 seconds).

I already said that I'm not keen on this approach.
Its a 'we can't do any better' type "solution".

If anything I'd be more inclined to make a change that allows to
more easily override the next_run computation via bpf.

It is regrettable that the request for this knob appears to be
intended to enable a potentially proprietary hardware offload
extension, implemented through a userspace daemon and a proprietary
SDK.

It's 2026, there is plenty of infrastructure to offload the connection
tracking upstream, such as act_ct.c and the flowtable.

Thank you Pablo, for the suggestion. We will look into adopting the
hardware offload feature soon.

Thanks,
Prasanna