Hi all, I am running into an odd issue where the kernel begins to drop packets because the connection tracking table is full. (I am running 2.6.26.5). A 'cat /proc/sys/net/netfilter/nf_conntrack_count' says 4096. But if I do a 'cat /proc/net/nf_conntrack | wc -l' then it says 4. A tail on /var/log/messages has: Feb 15 16:45:33 titan user.warn kernel: __ratelimit: 20 messages suppressed Feb 15 16:45:33 titan user.warn kernel: nf_conntrack: table full, dropping packet. I have an interface that allows me to do a 'nf_conntrack_flush' in kernel, but that seems to only clear the table of /proc/net/nf_conntrack and not the count the kernel has. I need a way to ensure that at say 95% there is a way to clear the "actual" table as well as the count...whichever that may be. There seems to be a disconnect between the implementation versus my understanding of how the system is working. Any help is appreciated. Afi -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
