nf_flow_tab...d_ct_timeout(9)

🌸 hey bestie, welcome to nf_flow_tab...d_ct_timeout(9) 🌸

okay so this is a page from the Kernel API Manual, and it's all about one lil function that keeps your offloaded conntrack entries from getting yeeted before their time. it's giving "small function, big job" energy. let's get into it 🫶

---

✨ NAME ✨

nf_flow_table_extend_ct_timeout — extends the ct timeout of an offloaded conntrack entry. that's literally the whole vibe. 💅

---

🦋 SYNOPSIS 🦋

void nf_flow_table_extend_ct_timeout (struct nf_conn *ct );

one function, one argument, zero drama. slay.

---

🎀 ARGUMENTS 🎀

• ct — the flowtable offloaded ct. like, the conntrack entry that's already been offloaded. hand it over and it gets its timeout extended. that's it, that's the whole argument 🧚

---

💖 DESCRIPTION 💖

okay so picture this. datapath lookups in the conntrack table will evict nf_conn entries if they have expired. expired = gone, no cap. 💀

now here's the plot twist 😭 — once nf_conn entries have been offloaded, nf_conntrack might not see any packets anymore. and because of that, ct->timeout is no longer refreshed, which means ct can be evicted. not the main character ending we wanted fr fr.

so how do we fix it? instead of doing an additional check on the offload bit for every single packet processed via nf_conntrack_in, we just set an arbitrary timeout large enough not to ever expire. that way we skip the check for the IPS_OFFLOAD_BIT from the packet path via nf_ct_is_expired. iconic efficiency honestly 👑

lowkey the whole point is: one big arbitrary timeout now, so you don't have to do a per-packet check later. it's the tradeoff and it ate. 🔥

---

🌈 SEE ALSO 🌈

• Kernel file ./net/netfilter/nf_flow_table_core.c — go read it bestie, it's right there 🍓
• nf_flow_table_tcp_timeout(9) — the sibling function, also very much worth a look ⭐

---

and that's the page!! 💜 this one lives under ./net/netfilter, it's dated October 2026, and yes the title really is nf_flow_tab...d_ct_timeout(9) (they truncated it, not me, don't come for me 🙈). anyway ily, go extend those timeouts, periodt. 🎀✨