ip_conntrack: table full, dropping packet.

A lot of clients I've seen have this issue, it really seems the default level is way too small.  Once this connection tracking table becomes full then packets get dropped which is obviously a bad thing.

One thing to be mindful of though is that 350 bytes of memory are used per entry so there is some justification for not keeping it too high.  However, if you have multiple servers running or high traffic daemons then you'll want to increase the level which is the only solution to avoid the dropped packets.

check to see how many connections there are:
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

check to see your limit:
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
65536

double your limit:
echo 131072 > /proc/sys/net/ipv4/ip_conntrack_max

Make the change permanent:


echo "net.ipv4.netfilter.ip_conntrack_max=131072" >> /etc/sysctl.conf

ip_conntrack, packet, linux, rhel, centos, debianip_conntrack, ve, default, packets, mindful, bytes, entry, justification, multiple, servers, daemons, ll, connections, proc, sys, ipv, netfilter, ip_conntrack_count, ip_conntrack_max, echo, quot, etc, sysctl, conf,

Latest Articles