Fri Jul 15, 2011 2:38 am
Connections that are closed (ACK for a FIN) are removed from the connection table. If the connection isn't observed to be closed it stays open - either because it's still active, or because the router didn't see it being closed (it's a stale connection that the endpoints intended to close but the router somehow didn't see it).
What is a good value? Depends on your network. It's hard to be generic here. Other platforms only apply this value to idle connections (the value resets whenever a packet is seen in the connection), but iptables applies this value from beginning to end. If you make this value too short then a valid connection that is passing data will be removed after that time period. I believe the Linux kernel default value (server oriented, not router oriented) is still 5 days. 1 day is probably fairly appropriate for most routers.
If you see a lot of connections where packet counters aren't increasing and they're not observed as closing you might want to investigate packet loss. Stale connections that idle for very long periods of time for a legitimate reason should be rather rare. Your network (or other networks between the two endpoints) may be dropping the last packet that should be closing the connection.