You end up in a situation where the firewall consumes far more resources than the sever itself. Unfortunately as you have discovered this sucks for stateless UDP servers serving large numbers of small requests. In principle it would be possible to build a NAT box that used a stateless approach for port forwards while maintaining a stateful approach for outgoing connections but it's simpler to just use stateful NAT for everything and it sounds like this is what your vendor is doing. Further down the filtered logs, the last log shown has a time of 23:14:13, which is out of range of the initial 10-minute quick filter. In the example below, the time of the first log is 23:34:18. acteristic of the state transitions within the TCP protocol 31 to prevent. So it has to wait for a timeout before removing the entry from it's state tracking tables. Filter the logs in Log Viewer using the quick filter for 10 minutes' worth of data. example, reconstruction of application-level streams and inter-connection.

The entry that tells us that the connection has not seen any traffic in both directions, will be replaced by the ASSURED flag, to be found close to the end of the entry. Unfortunately the firewall or NAT has no way of knowing when the client has finished talking to the server. of the universe, and you deserve to be happy before it all turns back into the state of oblivion. When a connection has seen traffic in both directions, the conntrack entry will erase the UNREPLIED flag, and then reset it. This allows rules like 'outgoing connections only' to be applied to UDP and allows reverse translations to be applied to response packets. Stateful firewalls and NATs therefore assume that packets with a given combination of source IP/source port/Destination IP/Destination port and the corresponding combination with source and destination swapped form part of a 'connection'. While there is no formal 'connection' with UDP there is still a convention that clients send requests and expect to get responses back with the source IP and port swapped with the Destinatoin IP and port.

Connection states unreplied