{"id":74655,"date":"2020-03-19T08:42:34","date_gmt":"2020-03-19T05:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh"},"modified":"2020-03-19T08:42:34","modified_gmt":"2020-03-19T05:42:34","slug":"kogda-linux-conntrack-vam-bolshe-ne-tovarishh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","title":{"rendered":"C\u00e2nd Linux conntrack nu \u00ee\u021bi mai este prieten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"C\u00e2nd Linux conntrack nu \u00ee\u021bi mai este prieten\" src=\"\/wp-content\/uploads\/2020\/03\/588a169e5cfe0714694b8d7ff03985d1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Urm\u0103rirea conexiunilor (\u201econntrack\u201d) este o func\u021bie esen\u021bial\u0103 a stivei de re\u021bea din nucleul Linux. Aceasta permite nucleului s\u0103 urm\u0103reasc\u0103 toate conexiunile logice de re\u021bea sau fluxurile, identific\u00e2nd astfel toate pachetele care formeaz\u0103 fiecare flux, pentru a putea fi procesate consecvent \u00eempreun\u0103.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Conntrack este o func\u021bie important\u0103 a nucleului, utilizat\u0103 \u00een anumite cazuri fundamentale:<\/p>\n<p><\/p>\n<ul>\n<li>NAT se bazeaz\u0103 pe informa\u021biile de la conntrack, permi\u021b\u00e2ndu-i s\u0103 proceseze uniform toate pachetele dintr-un singur flux. De exemplu, atunci c\u00e2nd un pod se adreseaz\u0103 unui serviciu Kubernetes, echilibratorul de sarcin\u0103 kube-proxy folose\u0219te NAT pentru a direc\u021biona traficul c\u0103tre un anumit pod din interiorul clusterului. Conntrack \u00eenregistreaz\u0103 c\u0103 pentru o anumit\u0103 conexiune toate pachetele c\u0103tre IP-ul serviciului trebuie s\u0103 fie trimise c\u0103tre acela\u0219i pod, iar pachetele returnate de podul backend-ului trebuie s\u0103 fie redirec\u021bionate de NAT \u00eenapoi c\u0103tre podul din care a venit cererea.<\/li>\n<li>Firewall-urile cu urm\u0103rirea st\u0103rii, cum ar fi Calico, se bazeaz\u0103 pe informa\u021biile de la conntrack pentru a ad\u0103uga traficul \u201ede r\u0103spuns\u201d \u00een lista alb\u0103. Acest lucru v\u0103 permite s\u0103 redacta\u021bi o politic\u0103 de re\u021bea care spune: \u201epermite\u021bi pod-ului meu s\u0103 se conecteze la orice adres\u0103 IP extern\u0103\u201d f\u0103r\u0103 a fi necesar s\u0103 scrie\u021bi o politic\u0103 pentru a permite explicit traficul de r\u0103spuns. (F\u0103r\u0103 aceasta, ar fi trebuit s\u0103 ad\u0103uga\u021bi o regul\u0103 mult mai pu\u021bin sigur\u0103 \u201epermit pachetelor \u00een podul meu din orice IP\u201d.)<\/li>\n<\/ul>\n<p><\/p>\n<p>\u00cen plus, conntrack \u00eembun\u0103t\u0103\u021be\u0219te de obicei performan\u021ba sistemului (reduc\u00e2nd consumul de timp al procesorului \u0219i timpul de \u00eent\u00e2rziere al pachetelor), deoarece doar primul pachet dintr-un flux<br \/>\ntrebuie s\u0103 treac\u0103 prin procesarea complet\u0103 a stivei de re\u021bea pentru a determina ce s\u0103 fac\u0103 cu acesta. Consulta\u021bi postarea \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/blog\/comparing-kube-proxy-modes-iptables-or-ipvs\/\">Compara\u021bia modurilor kube-proxy<\/a><\/noindex>\u201d pentru a vedea un exemplu despre cum func\u021bioneaz\u0103.<\/p>\n<p><\/p>\n<p>Cu toate acestea, conntrack are propriile sale limit\u0103ri\u2026<\/p>\n<p><\/p>\n<h3 id=\"itak-gde-vse-poshlo-ne-tak\">A\u0219adar, unde a mers totul prost?<\/h3>\n<p><\/p>\n<p>Tabelul conntrack are o dimensiune maxim\u0103 personalizabil\u0103, iar dac\u0103 devine plin, conexiunile \u00eencep de obicei s\u0103 fie refuzate sau \u00eentrerupte. Pentru a gestiona traficul majorit\u0103\u021bii aplica\u021biilor, \u00een tabel este disponibil\u0103 o cantitate suficient\u0103 de spa\u021biu liber \u0219i acest lucru nu va deveni niciodat\u0103 o problem\u0103. Totu\u0219i, exist\u0103 c\u00e2teva scenarii \u00een care merit\u0103 s\u0103 lua\u021bi \u00een considerare utilizarea tabelului conntrack:<\/p>\n<p><\/p>\n<ul>\n<li>Cazul cel mai evident este atunci c\u00e2nd serverul dumneavoastr\u0103 proceseaz\u0103 un num\u0103r extrem de mare de conexiuni active simultane. De exemplu, dac\u0103 tabela dumneavoastr\u0103 conntrack este setat\u0103 la 128k \u00eenregistr\u0103ri, dar ave\u021bi &gt; 128k conexiuni simultane, cu siguran\u021b\u0103 ve\u021bi \u00eent\u00e2mpina o problem\u0103!<\/li>\n<li>Un caz pu\u021bin mai pu\u021bin evident: dac\u0103 serverul dumneavoastr\u0103 proceseaz\u0103 un num\u0103r foarte mare de conexiuni pe secund\u0103. Chiar dac\u0103 conexiunile sunt de scurt\u0103 durat\u0103, ele continu\u0103 s\u0103 fie urm\u0103rite de Linux pentru o perioad\u0103 de timp (implicit 120s). De exemplu, dac\u0103 tabela dumneavoastr\u0103 conntrack este setat\u0103 la 128k \u00eenregistr\u0103ri \u0219i \u00eencerca\u021bi s\u0103 procesa\u021bi 1100 de conexiuni pe secund\u0103, acestea vor dep\u0103\u0219i dimensiunea tabelei conntrack, chiar dac\u0103 conexiunile sunt foarte efemere (128k \/ 120s = 1092 conexiuni \/ s).<\/li>\n<\/ul>\n<p><\/p>\n<p>Exist\u0103 c\u00e2teva tipuri ni\u0219ate de aplica\u021bii care se \u00eencadreaz\u0103 \u00een aceste categorii. \u00cen plus, dac\u0103 ave\u021bi mul\u021bi adversari, umplerea tabelei conntrack a serverului dumneavoastr\u0103 cu multe conexiuni semi-\u00eenchise poate fi utilizat\u0103 ca parte a unei atacuri de tip \u201erefuz de serviciu\u201d (DOS). \u00cen ambele cazuri, conntrack poate deveni un g\u00e2t de blocare \u00een sistemul dumneavoastr\u0103. \u00cen unele cazuri, ajust\u0103rile parametrilor tabelei conntrack pot fi suficiente pentru a satisface nevoile dumneavoastr\u0103 \u2014 prin cre\u0219terea dimensiunii sau reducerea timpurilor de expirare conntrack (dar dac\u0103 face\u021bi asta gre\u0219it, ve\u021bi \u00eent\u00e2mpina mari dificult\u0103\u021bi). Pentru alte cazuri, va fi necesar s\u0103 ocoli\u021bi conntrack pentru traficul agresiv.<\/p>\n<p><\/p>\n<h4 id=\"realnyy-primer\">Un exemplu real<\/h4>\n<p><\/p>\n<p>S\u0103 d\u0103m un exemplu concret: un mare furnizor de SaaS cu care am lucrat avea o serie de servere memcached pe gazde (nu ma\u0219ini virtuale), fiecare dintre acestea proces\u00e2nd 50K+ conexiuni efemere pe secund\u0103.<\/p>\n<p><\/p>\n<p>Ei au experimentat cu configura\u021bia conntrack, m\u0103rind dimensiunile tabelei \u0219i reduc\u00e2nd timpul de urm\u0103rire, dar configura\u021bia a devenit nesigur\u0103, consumul de RAM a crescut semnificativ, ceea ce a fost o problem\u0103 (de ordinul GB!), iar conexiunile erau at\u00e2t de scurte \u00eenc\u00e2t conntrack nu genera c\u00e2\u0219tigul de performan\u021b\u0103 obi\u0219nuit (reducerea consumului de CPU sau \u00eent\u00e2rzierilor pachetelor).<\/p>\n<p><\/p>\n<p>Ca alternativ\u0103, ei s-au adresat Calico. Politicile de re\u021bea Calico permit evitarea utiliz\u0103rii conntrack pentru un anumit tip de trafic (folosind op\u021biunea doNotTrack pentru politici). Aceasta le-a oferit nivelul de performan\u021b\u0103 necesar, plus un nivel suplimentar de securitate oferit de Calico.<\/p>\n<p><\/p>\n<h4 id=\"na-chto-pridetsya-poyti-chtoby-oboyti-conntrack\">Ce sunt dispus s\u0103 fac\u0103 pentru a \u00eenl\u0103tura conntrack?<\/h4>\n<p><\/p>\n<ul>\n<li>Politicile de re\u021bea do-not-track ar trebui \u00een general s\u0103 fie simetrice. \u00cen cazul unui furnizor SaaS: aplica\u021biile lor func\u021bionau \u00een interiorul unei zone protejate \u0219i, prin urmare, folosind politica de re\u021bea, puteau ad\u0103uga pe lista alb\u0103 traficul de la alte aplica\u021bii specifice c\u0103rora le era permis accesul la memcached.<\/li>\n<li>Politica do-not-track nu \u021bine cont de direc\u021bia conexiunii. Astfel, \u00een cazul unei bre\u0219e la serverul memcached, teoretic se poate \u00eencerca conectarea la oricare dintre clien\u021bii memcached, dac\u0103 folose\u0219te portul de surs\u0103 corect. Totu\u0219i, dac\u0103 ai definit corect politica de re\u021bea pentru clien\u021bii t\u0103i memcached, aceste \u00eencerc\u0103ri de conectare vor fi respinse pe partea clientului.<\/li>\n<li>Politica do-not-track se aplic\u0103 fiec\u0103rui pachet, spre deosebire de politicile obi\u0219nuite care se aplic\u0103 doar primului pachet din flux. Aceasta poate cre\u0219te consumul de resurse CPU pentru fiecare pachet, deoarece trebuie aplicat\u0103 politica pentru fiecare pachet. Dar pentru conexiunile de scurt\u0103 durat\u0103, acest consum este echilibrat de reducerea cheltuielilor de resurse pentru procesarea conntrack. De exemplu, \u00een cazul unui furnizor SaaS, num\u0103rul de pachete pentru fiecare conexiune a fost foarte mic, astfel c\u0103 cheltuielile suplimentare de resurse CPU pentru aplicarea politicilor fiec\u0103rui pachet au fost justificate.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"pristupim-k-testam\">S\u0103 \u00eenceap\u0103 testele<\/h4>\n<p><\/p>\n<p>Am efectuat un test pe un pod cu un server memcached \u0219i numeroase poduri client memcached care rulau pe noduri \u00eendep\u0103rtate, astfel \u00eenc\u00e2t s\u0103 putem genera un num\u0103r foarte mare de conexiuni pe secund\u0103. Serverul cu podul serverului memcached avea 8 nuclee \u0219i 512k \u00eenregistr\u0103ri \u00een tabelul conntrack (dimensiunea standard a tabelului pentru gazd\u0103).<br \/>\nAm m\u0103surat diferen\u021ba de performan\u021b\u0103 \u00eentre: f\u0103r\u0103 politic\u0103 de re\u021bea; cu o politic\u0103 Calico obi\u0219nuit\u0103; \u0219i cu politica Calico do-not-track.<\/p>\n<p><\/p>\n<p>Pentru primul test, am setat num\u0103rul de conexiuni la 4.000 pe secund\u0103, astfel c\u0103 ne-am putut concentra pe diferen\u021ba de consum de CPU. Aici nu au existat diferen\u021be semnificative \u00eentre absen\u021ba politicii \u0219i politica obi\u0219nuit\u0103, \u00eens\u0103 politica do-not-track a crescut consumul de CPU cu aproximativ 20%.<\/p>\n<p>\n<img decoding=\"async\" alt=\"C\u00e2nd Linux conntrack nu \u00ee\u021bi mai este prieten\" src=\"\/wp-content\/uploads\/2020\/03\/6762772cb8e5f089a3ed444aff8cb8f4.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00cen al doilea test, am ini\u021biat c\u00e2t mai multe conexiuni posibil cu clien\u021bii no\u0219tri \u0219i am m\u0103surat num\u0103rul maxim de conexiuni pe secund\u0103 pe care serverul nostru memcached a reu\u0219it s\u0103 le gestioneze. A\u0219a cum ne a\u0219teptam, \u00een cazul \u201ef\u0103r\u0103 politici\u201d \u0219i \u201epolitica obi\u0219nuit\u0103\u201d, ambele au atins limita conntrack de peste 4.000 de conexiuni pe secund\u0103 (512k \/ 120s = 4.369 conexiuni\/s). Cu politica do-not-track, clien\u021bii no\u0219tri au trimis 60.000 de conexiuni pe secund\u0103 f\u0103r\u0103 probleme. Suntem siguri c\u0103 am putea cre\u0219te acest num\u0103r conect\u00e2nd mai mul\u021bi clien\u021bi, dar consider\u0103m c\u0103 aceste cifre sunt deja suficiente pentru a ilustra mesajul acestui articol!<\/p>\n<p>\n<img decoding=\"async\" alt=\"C\u00e2nd Linux conntrack nu \u00ee\u021bi mai este prieten\" src=\"\/wp-content\/uploads\/2020\/03\/f3beeb1793a3158018274079da953a2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h4 id=\"zaklyuchenie\">Concluzie<\/h4>\n<p><\/p>\n<p>Conntrack este o func\u021bie important\u0103 a nucleului. \u00ce\u0219i \u00eendepline\u0219te foarte bine rolul. Este utilizat adesea de componente cheie ale sistemului. Cu toate acestea, \u00een anumite scenarii, suprasarcina cauzat\u0103 de conntrack dep\u0103\u0219e\u0219te avantajele obi\u0219nuite pe care le ofer\u0103. \u00cen acest scenariu, politicile de re\u021bea Calico pot fi folosite pentru a dezactiva selectiv utilizarea conntrack, sporind astfel nivelul de securitate \u00een re\u021bea. Pentru tot restul traficului, conntrack r\u0103m\u00e2ne partenerul vostru!<\/p>\n<p><\/p>\n<h2 id=\"takzhe-chitayte-drugie-stati-v-nashem-bloge\">Citi\u021bi \u0219i alte articole de pe blogul nostru:<\/h2>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473578\/\">Compilarea modulelor dinamice pentru Nginx<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473014\/\">Introducerea \u00een Autorizarea Kubernetes a Hashicorp Consul<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/426543\/\">Backup-uri Stateful \u00een Kubernetes<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/424717\/\">Backup-ul unui num\u0103r mare de proiecte web heterogene<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/347526\/\">Bot Telegram pentru Redmine. Cum s\u0103 \u00ee\u021bi simplifici via\u021ba \u021bie \u0219i celorlal\u021bi<\/a><\/noindex><\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/492686\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47C\u00e2nd Linux conntrack nu mai este prietenul t\u0103u | ProHoster","description":"Urm\u0103rirea conexiunilor (\u201econntrack\u201d) este.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster","og:description":"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-19T05:42:34+00:00","article:modified_time":"2020-03-19T05:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:10:25","updated":"2022-10-05 19:52:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=74655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/74656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=74655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=74655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=74655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}