We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you wouldn't be able to establish any new connections. However, I've been doing some testing with SYN flooding and SYNPROXY DDoS protection. I've found that after hitting nf_conntrack_max by way of a SYN flood I can still establish connections to the server.

Using SYNPROXY keeps the conntrack table to established connections, but with or without it I can still connect to the server with no issues.

Does anyone have any info on this?


I came across lockless TCP listeners in 4.4:


I'm wondering if this is part of it.

migrated from serverfault.com Apr 27 '17 at 23:55

This question came from our site for system and network administrators.


If the reuse of the ports is enabled and/or nonblock mode on sockets of the connections then propably you will be able to connect even if the limit is exceeded which will be virtually exceeded not actually ... check also the firewall if there is a filter about flood

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.