2

We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause:

kernel: nf_conntrack: table full, dropping packet

As I understand it, this is the conntrack module, which does some stateful tracking of connection, reporting that the table used to store the connection details is full.

From the research I have done, there seem to be two ways to mitigate this:

  1. Increase size of the table.

  2. Remove the module from the system altogether.

However, neither /proc/sys/net/ipv4/ip_conntrack_maxnor /proc/sys/net/ipv4/netfilter/ip_conntrack_max exist on this machine (there is no ipv4 catalogue under net).

If I do lsmod I get no results.

So, I'm a bit confused - perhaps someone could clarify the situation for me?

  • Is conntrack installed? If so, where are the settings? And why doesn't it show up in lsmod?
  • If conntrack is not installed, what is issuing the table full messages?

Thank you

3
  • Really? lsmod|grep conntrack doesn't yield results? Maybe you're using IPv6?
    – Jan
    Sep 30, 2014 at 11:06
  • Right, lsmod|grep conntrack comes back empty (as does lsmod on it's own). Definitely using ip4, although both ip4 and ip6 are configured on this server - it's a virtualized server if that makes any difference.
    – UpTheCreek
    Sep 30, 2014 at 11:12
  • I have nf_conntrack_max directly in /proc/sys/net and in /proc/sys/net/netfilter. Sep 30, 2014 at 12:01

1 Answer 1

1

I had the same issue on servers running with Ubuntu 18.04. Even though the nf_conntrack module was not loaded at startup, later during traffic spikes, messages were dropped (nf_conntrack: table full, dropping packet).

I'm not aware of a way to disable the functionality, but I ended up explicitly loading the module, so I could overwrite the table size.

First, make sure that nf_conntrack gets immediately loaded by including it in /etc/modules:

nf_conntrack

Then increase its table size, which otherwise will depend on the memory size of the server, by overwriting the defaults in /etc/sysctl.conf:

net.netfilter.nf_conntrack_max=262144
net.nf_conntrack_max=262144

To verify:

$ cat /proc/sys/net/netfilter/nf_conntrack_max 
262144

As said, it was tested on Ubuntu 18.04, but I would expect it to work also on Debian.

For some further background, why nf_conntrack might get later loaded, even if it is not present after booting up, this related answer has an example where the module gets automatically loaded when iptables is called. Adding it explicitly to /etc/modules eliminates that kind of complexity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .