Our Ubuntu server runs as a router for thousands of devices. With the growing number of connecting clients we have noticed 3 overflow problems in the kernel log:

1. Route cache chain too long 
2. Neighbor table overflow
3. ip conntrack table full

All 3 table sizes can be extended, and we did so, but we do not understand differences between them, and mechanisms involved.

So can someone in simple terms please explain differences between kernel route cache and neighbor table? They seem to serve similar purpose, work with the same mechanisms (garbage collected) and both manage routes.

Explanation for the connntrack table will also be welcome :)


Route Cache and Neighbor Tables are somewhat similar in that they both help decide where to send a packet next.

The difference is the Neighbor Table caches entries at the layer 2 (ethernet) level; it helps translate IP addresses into MAC addresses. The ARP protocol is used to query for new entries to cache.

A Route Cache works at layer 3 (IP). The simplest form maps destination IP addresses to "next hops" (that is: where to send a packet from this node). Non-routers typically have a completely static cache, that just maps all traffic to a single "default route".

There are more complicated cache policies, that would take into effect quality of service constraints, source and destination addresses, etc. The IP routing guide provides a good overview.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.