A server suddenly show ip_conntrack: table full, dropping packet.Found that ip_conntrack will record TCP established connection , and default timeout is 5 days ! Yes, 5 days! (432,000s),So there may be problem for a busy server… S(0): upgrade ip_conntrack_max cat the value of ip_conntrack_max :cat /proc/sys/net/ipv4/ip_conntrack_maxInput the value you want each ip_conntrack buffer takes 292bytesecho “81920″ > /proc/sys/net/ipv4/ip_conntrack_maxorsysctl -w net.ipv4.ip_conntrack_max=81920
S(1): Change ip_conntrack timeout echo “1800″ > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_establishedorsysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=1800
More check status grep conn /proc/slabinfo e.g. : ip_conntrack 3024 4090 384 409 409 1
ip_conntrack the cache name3024 the number of currently active objects4090 the total number of available objects384 the size of each object in bytes409 the number of pages with at least one active object409 the total number of allocated pages1 the number of pages per slab are given
man slabinfo can get more info.
Get the top 5 ip cat /proc/net/ip_conntrack | cut -d ‘ ‘ -f 10 | cut -d ‘=’ -f 2 | sort | uniq -c | sort -nr | head -n 5you will know which ip got most session, if really too much …..froxy ? P2P ?