{"id":74655,"date":"2020-03-19T08:42:34","date_gmt":"2020-03-19T05:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh"},"modified":"2020-03-19T08:42:34","modified_gmt":"2020-03-19T05:42:34","slug":"kogda-linux-conntrack-vam-bolshe-ne-tovarishh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","title":{"rendered":"Ke\u010f v\u00e1m Linux conntrack u\u017e nie je priate\u013eom","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Ke\u010f v\u00e1m Linux conntrack u\u017e nie je priate\u013eom\" src=\"\/wp-content\/uploads\/2020\/03\/588a169e5cfe0714694b8d7ff03985d1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Sledovanie pripojen\u00ed (\u201econntrack\u201c) je z\u00e1kladn\u00e1 funkcia sie\u0165ov\u00e9ho z\u00e1sobn\u00edka jadra Linux. Umo\u017e\u0148uje jadru sledova\u0165 v\u0161etky logick\u00e9 sie\u0165ov\u00e9 pripojenia alebo toky a tak identifikova\u0165 v\u0161etky pakety, ktor\u00e9 tvoria ka\u017ed\u00fd tok, aby ich bolo mo\u017en\u00e9 spracova\u0165 postupne spolu.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Conntrack je d\u00f4le\u017eit\u00e1 funkcia jadra, ktor\u00e1 sa pou\u017e\u00edva v niektor\u00fdch z\u00e1kladn\u00fdch pr\u00edpadoch:<\/p>\n<p><\/p>\n<ul>\n<li>NAT sa opiera o inform\u00e1cie z conntrack, a preto dok\u00e1\u017ee rovnako spracov\u00e1va\u0165 v\u0161etky pakety z jedn\u00e9ho toku. Napr\u00edklad, ke\u010f pod komunikuje so slu\u017ebou Kubernetes, vyva\u017eova\u010d za\u0165a\u017eenia kube-proxy pou\u017e\u00edva NAT na smerovanie prev\u00e1dzky na konkr\u00e9tny pod v r\u00e1mci klastru. Conntrack zaznamen\u00e1va, \u017ee pre ur\u010dit\u00e9 pripojenie musia by\u0165 v\u0161etky pakety k IP slu\u017eby odosielan\u00e9 do toho ist\u00e9ho podu, a \u017ee pakety vracan\u00e9 backendov\u00fdm podom by mali by\u0165 NAT-om nasmerovan\u00e9 sp\u00e4\u0165 do podu, z ktor\u00e9ho pri\u0161la po\u017eiadavka.<\/li>\n<li>Firewally so sledovan\u00edm stavu, ako Calico, sa opieraj\u00fa o inform\u00e1cie z conntrack, aby prid\u00e1vali \u201eodpovedaj\u00facu\u201c prev\u00e1dzku na biely zoznam. To v\u00e1m umo\u017e\u0148uje nap\u00edsa\u0165 sie\u0165ov\u00fa politiku, ktor\u00e1 hovor\u00ed: \u201ePovoli\u0165 m\u00f4jmu podu pripoji\u0165 sa k ak\u00e9muko\u013evek vzdialen\u00e9mu IP adresu\u201c bez potreby p\u00edsa\u0165 politiku na explicitn\u00e9 povolenie odpovedaj\u00facej prev\u00e1dzky. (Bez toho by ste museli prida\u0165 ove\u013ea menej bezpe\u010dn\u00e9 pravidlo \u201epovoli\u0165 pakety do m\u00f4jho podu z ak\u00e9hoko\u013evek IP\u201c.)<\/li>\n<\/ul>\n<p><\/p>\n<p>Okrem toho conntrack zvy\u010dajne zvy\u0161uje v\u00fdkon syst\u00e9mu (zn\u00ed\u017een\u00edm spotreby procesorov\u00e9ho \u010dasu a latencie paketov), preto\u017ee len prv\u00fd paket v toku<br \/>\nmus\u00ed prejs\u0165 \u00fapln\u00fdm spracovan\u00edm z\u00e1sobn\u00edka siete, aby sa ur\u010dilo, \u010do s n\u00edm robi\u0165. Pozrite sa na pr\u00edspevok \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/blog\/comparing-kube-proxy-modes-iptables-or-ipvs\/\">Porovnanie re\u017eimov kube-proxy<\/a><\/noindex>\u201c, aby ste videli pr\u00edklad toho, ako to funguje.<\/p>\n<p><\/p>\n<p>Napriek tomu m\u00e1 conntrack svoje obmedzenia\u2026<\/p>\n<p><\/p>\n<h3 id=\"itak-gde-vse-poshlo-ne-tak\">Tak kde sa v\u0161etko pokazilo?<\/h3>\n<p><\/p>\n<p>Tabu\u013eka conntrack m\u00e1 prisp\u00f4sobite\u013en\u00fa maxim\u00e1lnu ve\u013ekos\u0165, a ak je naplnen\u00e1, pripojenia zvy\u010dajne za\u010d\u00ednaj\u00fa odmieta\u0165 alebo preru\u0161i\u0165. Pre spracovanie prev\u00e1dzky v\u00e4\u010d\u0161iny aplik\u00e1ci\u00ed je v tabu\u013eke zvy\u010dajne dostatok vo\u013en\u00e9ho miesta a nikdy to nebude probl\u00e9m. Napriek tomu existuje nieko\u013eko scen\u00e1rov, pri ktor\u00fdch stoj\u00ed za to zv\u00e1\u017ei\u0165 pou\u017eitie tabu\u013eky conntrack:<\/p>\n<p><\/p>\n<ul>\n<li>Najzjavnej\u0161\u00ed pr\u00edpad nast\u00e1va, ak v\u00e1\u0161 server spracov\u00e1va extr\u00e9mne ve\u013ek\u00e9 mno\u017estvo s\u00fa\u010dasne akt\u00edvnych pripojen\u00ed. Napr\u00edklad, ak je va\u0161a tabu\u013eka conntrack nastaven\u00e1 na 128k z\u00e1znamov, ale m\u00e1te viac ako 128k s\u00fa\u010dasn\u00fdch pripojen\u00ed, ur\u010dite sa stretnete s probl\u00e9mom!<\/li>\n<li>Menej o\u010dividn\u00fd pr\u00edpad: ak v\u00e1\u0161 server spracov\u00e1va ve\u013emi ve\u013ek\u00e9 mno\u017estvo pripojen\u00ed za sekundu. Aj ke\u010f s\u00fa pripojenia kr\u00e1tkodob\u00e9, st\u00e1le ich Linux sleduje po\u010das ur\u010dit\u00e9ho \u010dasov\u00e9ho obdobia (predvolene 120s). Napr\u00edklad, ak je va\u0161a tabu\u013eka conntrack nastaven\u00e1 na 128 tis. z\u00e1znamov a pok\u00fa\u0161ate sa spracova\u0165 1100 pripojen\u00ed za sekundu, presiahnu kapacitu tabu\u013eky conntrack, aj ke\u010f s\u00fa pripojenia ve\u013emi kr\u00e1tke (128k \/ 120s = 1092 pripojen\u00ed\/s).<\/li>\n<\/ul>\n<p><\/p>\n<p>Existuje nieko\u013eko \u0161pecifick\u00fdch typov aplik\u00e1ci\u00ed, ktor\u00e9 spadaj\u00fa do t\u00fdchto kateg\u00f3ri\u00ed. Navy\u0161e, ak m\u00e1te ve\u013ea nepriate\u013eov, zaplnenie tabu\u013eky conntrack v\u00e1\u0161ho servera mno\u017estvom polo-otvoren\u00fdch pripojen\u00ed m\u00f4\u017ee by\u0165 pou\u017eit\u00e9 v r\u00e1mci \u00fatoku typu \u201eodmietnutie slu\u017eby\u201c (DOS). V oboch pr\u00edpadoch sa conntrack m\u00f4\u017ee sta\u0165 obmedzuj\u00facim faktorom vo va\u0161ej syst\u00e9me. V niektor\u00fdch pr\u00edpadoch m\u00f4\u017ee by\u0165 dostato\u010dn\u00e9 upravi\u0165 parametre tabu\u013eky conntrack \u2014 zv\u00fd\u0161en\u00edm ve\u013ekosti alebo zn\u00ed\u017een\u00edm \u010dasov\u00fdch limitov conntrack (ale ak to sprav\u00edte nespr\u00e1vne, naraz\u00edte na ve\u013ek\u00e9 \u0165a\u017ekosti). V in\u00fdch pr\u00edpadoch bude nevyhnutn\u00e9 ob\u00eds\u0165 conntrack pre agres\u00edvny prenos.<\/p>\n<p><\/p>\n<h4 id=\"realnyy-primer\">Skuto\u010dn\u00fd pr\u00edklad<\/h4>\n<p><\/p>\n<p>Uve\u010fme konkr\u00e9tny pr\u00edklad: jeden ve\u013ek\u00fd poskytovate\u013e SaaS, s ktor\u00fdm sme spolupracovali, mal nieko\u013eko memcached serverov na hostite\u013eoch (nie virtu\u00e1lnych strojoch), z ktor\u00fdch ka\u017ed\u00fd spracov\u00e1val viac ako 50K kr\u00e1tkodob\u00fdch pripojen\u00ed za sekundu.<\/p>\n<p><\/p>\n<p>Experimentovali s konfigur\u00e1ciou conntrack, zvy\u0161ovali ve\u013ekosti tabuliek a skracovali \u010das sledovania, no konfigur\u00e1cia bola nestabiln\u00e1, pri\u010dom sa zna\u010dne zv\u00fd\u0161ila spotreba RAM, \u010do bol probl\u00e9m (pribli\u017ene GB!), a pripojenia boli tak\u00e9 kr\u00e1tke, \u017ee conntrack nevytv\u00e1ral svoj obvykl\u00fd zisk v oblasti v\u00fdkonu (zn\u00ed\u017eenie spotreby CPU alebo oneskorenia paketov).<\/p>\n<p><\/p>\n<p>Ako alternat\u00edvu sa obr\u00e1tili na Calico. Sie\u0165ov\u00e9 politiky Calico umo\u017e\u0148uj\u00fa nepou\u017e\u00edva\u0165 conntrack pre ur\u010dit\u00fd typ prev\u00e1dzky (pou\u017eit\u00edm mo\u017enosti doNotTrack pre politiky). To im poskytlo potrebn\u00fa \u00farove\u0148 v\u00fdkonu plus \u010fal\u0161iu \u00farove\u0148 bezpe\u010dnosti, ktor\u00fa poskytuje Calico.<\/p>\n<p><\/p>\n<h4 id=\"na-chto-pridetsya-poyti-chtoby-oboyti-conntrack\">\u010co bud\u00fa musie\u0165 urobi\u0165, aby obch\u00e1dzali conntrack?<\/h4>\n<p><\/p>\n<ul>\n<li>Sie\u0165ov\u00e9 politiky do-not-track by mali by\u0165 symetrick\u00e9. V pr\u00edpade poskytovate\u013ea SaaS: ich aplik\u00e1cie fungovali vo vn\u00fatri chr\u00e1nen\u00e9ho priestoru a preto pomocou sie\u0165ovej politiky mohli prida\u0165 do bieleho zoznamu prev\u00e1dzku z in\u00fdch konkr\u00e9tnych aplik\u00e1ci\u00ed, ktor\u00fdm bol umo\u017enen\u00fd pr\u00edstup k memcached.<\/li>\n<li>Politika do-not-track nezoh\u013ead\u0148uje smer pripojenia. Tak\u017ee v pr\u00edpade, \u017ee by bol server memcached napadnut\u00fd, teoreticky by sa d\u00e1 pok\u00fasi\u0165 pripoji\u0165 k \u013eubovo\u013en\u00e9mu z klientov memcached, ak pou\u017e\u00edva spr\u00e1vny p\u00f4vodn\u00fd port. Av\u0161ak, ak ste spr\u00e1vne definovali sie\u0165ov\u00fa politiku pre svojich klientov memcached, tieto pokusy o pripojenie bud\u00fa na strane klienta aj tak odmietnut\u00e9.<\/li>\n<li>Politika do-not-track sa uplat\u0148uje na ka\u017ed\u00fd paket, na rozdiel od be\u017en\u00fdch polit\u00edk, ktor\u00e9 sa uplat\u0148uj\u00fa len na prv\u00fd paket z toku. To m\u00f4\u017ee zv\u00fd\u0161i\u0165 spotrebu CPU na jeden paket, preto\u017ee pre ka\u017ed\u00fd paket je potrebn\u00e9 uplatni\u0165 politiku. Ale pre kr\u00e1tkodob\u00e9 pripojenia je t\u00e1to spotreba vyv\u00e1\u017een\u00e1 zn\u00ed\u017een\u00edm spotreby zdrojov na spracovanie conntrack. Napr\u00edklad, v pr\u00edpade poskytovate\u013ea SaaS, po\u010det paketov pre ka\u017ed\u00e9 pripojenie bol ve\u013emi n\u00edzky, tak\u017ee dodato\u010dn\u00e1 spotreba CPU pri uplat\u0148ovan\u00ed polit\u00edk na ka\u017ed\u00fd paket bola opodstatnen\u00e1.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"pristupim-k-testam\">Prejdime k testom<\/h4>\n<p><\/p>\n<p>Na\u0161 test prebiehal na jednom pode s memcached serverom a mnoh\u00fdmi podmi memcached klientov be\u017eiacimi na vzdialen\u00fdch nodoch, \u010d\u00edm sme mohli dosahova\u0165 ve\u013ek\u00e9 mno\u017estvo pripojen\u00ed za sekundu. Server s podom memcached servera mal 8 jadier a 512k z\u00e1znamov v conntrack tabu\u013eke (\u0161tandardne nastaven\u00e1 ve\u013ekos\u0165 tabu\u013eky pre hostite\u013ea).<br \/>\nMerali sme rozdiel vo v\u00fdkone medzi: bez sie\u0165ovej politiky; s be\u017enou politiku Calico; a politikou Calico do-not-track.<\/p>\n<p><\/p>\n<p>Pre prv\u00fd test sme nastavili po\u010det pripojen\u00ed na 4 000 za sekundu, tak\u017ee sme sa mohli zamera\u0165 na rozdiel v spotrebe CPU. Tu neboli \u017eiadne v\u00fdznamn\u00e9 rozdiely medzi absenciou politiky a be\u017enou politikou, ale politika do-not-track zv\u00fd\u0161ila spotrebu CPU o pribli\u017ene 20 %:<\/p>\n<p>\n<img decoding=\"async\" alt=\"Ke\u010f v\u00e1m Linux conntrack u\u017e nie je priate\u013eom\" src=\"\/wp-content\/uploads\/2020\/03\/6762772cb8e5f089a3ed444aff8cb8f4.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V druhom teste sme spustili to\u013eko pripojen\u00ed, ko\u013eko mohli na\u0161i klienti generova\u0165 a merali sme maxim\u00e1lny po\u010det pripojen\u00ed za sekundu, ktor\u00e9 dok\u00e1zal n\u00e1\u0161 server memcached spracova\u0165. Ako sme o\u010dak\u00e1vali, pri 'bez polit\u00edk' a 'be\u017enej politike' obidve dosiahli limit conntrack viac ako 4 000 pripojen\u00ed za sekundu (512k \/ 120s = 4 369 pripojen\u00ed\/s). S politikou do-not-track na\u0161i klienti odosielali 60 000 pripojen\u00ed za sekundu bez ak\u00fdchko\u013evek probl\u00e9mov. Sme si ist\u00ed, \u017ee by sme mohli toto \u010d\u00edslo zv\u00fd\u0161i\u0165 pripojen\u00edm v\u00e4\u010d\u0161ieho po\u010dtu klientov, ale c\u00edtime, \u017ee tieto \u010d\u00edsla u\u017e sta\u010dia na ilustrovanie posolstva tohto \u010dl\u00e1nku!<\/p>\n<p>\n<img decoding=\"async\" alt=\"Ke\u010f v\u00e1m Linux conntrack u\u017e nie je priate\u013eom\" src=\"\/wp-content\/uploads\/2020\/03\/f3beeb1793a3158018274079da953a2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h4 id=\"zaklyuchenie\">Z\u00e1ver<\/h4>\n<p><\/p>\n<p>Conntrack je d\u00f4le\u017eit\u00e1 funkcia jadra. Skvele pln\u00ed svoju \u00falohu. \u010casto ho pou\u017e\u00edvaj\u00fa k\u013e\u00fa\u010dov\u00e9 komponenty syst\u00e9mu. Av\u0161ak, v niektor\u00fdch \u0161pecifick\u00fdch scen\u00e1roch pre\u0165a\u017eenie sp\u00f4soben\u00e9 conntrack preva\u017euje nad be\u017en\u00fdmi v\u00fdhodami, ktor\u00e9 poskytuje. V tejto situ\u00e1cii m\u00f4\u017eu by\u0165 sie\u0165ov\u00e9 politiky Calico pou\u017eit\u00e9 na selekt\u00edvne vypnutie pou\u017e\u00edvania conntrack, pri\u010dom sa zvy\u0161uje \u00farove\u0148 sie\u0165ovej bezpe\u010dnosti. Pre v\u0161etok ostatn\u00fd dopravn\u00fd tok zost\u00e1va conntrack va\u0161\u00edm spojencom!<\/p>\n<p><\/p>\n<h2 id=\"takzhe-chitayte-drugie-stati-v-nashem-bloge\">\u010c\u00edtajte tie\u017e \u010fal\u0161ie \u010dl\u00e1nky na na\u0161om blogu:<\/h2>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473578\/\">Zostavenie dynamick\u00fdch modulov pre Nginx<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473014\/\">\u00davod do autoriz\u00e1cie Kubernetes v Hashicorp Consul<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/426543\/\">Z\u00e1lohy Stateful v Kubernetes<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/424717\/\">Z\u00e1lohovanie ve\u013ek\u00e9ho mno\u017estva heterog\u00e9nnych webov\u00fdch projektov<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/347526\/\">Telegram bot pre Redmine. Ako si u\u013eah\u010di\u0165 \u017eivot sebe a ostatn\u00fdm<\/a><\/noindex><\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/492686\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ke\u010f v\u00e1m Linux conntrack u\u017e nie je spojencom | ProHoster","description":"Sledovanie pripojen\u00ed ('conntrack') je.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster","og:description":"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-19T05:42:34+00:00","article:modified_time":"2020-03-19T05:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:10:25","updated":"2022-10-05 19:52:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=74655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/74656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=74655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=74655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=74655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}