On Mon, Feb 15, 2010 at 11:00 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: > > On Monday 2010-02-15 19:04, Afi Gjermund wrote: >>>>> >>>>> I am running into an odd issue where the kernel begins to drop packets >>>>> because the connection tracking table is full. (I am running >>>>> 2.6.26.5). >>>>> >>>>> A 'cat /proc/sys/net/netfilter/nf_conntrack_count' says 4096. But if >>>>> I do a 'cat /proc/net/nf_conntrack | wc -l' then it says 4. >>>> >>>>Conntracks might exist and not be in the global table anymore, >>>>f.i. when referenced by a packet. The difference in your case >>>>seems pretty extreme, so I'd guess that packets are leaked >>>>somewhere. >>> >>> So, that would make for 4092 expected connections then? >>> >>> Afi, what would `conntrack -L expect` give? > (meant: conntrack -L expect | wc -l) > >>One thing to >>note is, I have stopped any traffic flowing through the device, and >>yet I am still receiving the kernel drop messages. Any change its >>connection tracking on the loopback? ( I use the loopback for IPC ). > > Yes. conntrack does not care about what interface packets > come in or go out on. Unless it's NOTRACKed, it's counted. > Okay, after some tinkering I was able to get the userspace application going. The results, however, do not seem that helpful. root@00:00:10:73:77:64 ~# ./conntrack -L expect | wc -l conntrack v0.9.14 (conntrack-tools): 0 expectations have been shown. 0 root@titan ~# ./conntrack -L conntrack udp 17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=89099 bytes=12968758 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=110358 bytes=17041625 [ASSURED] mark=0 use=1 udp 17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=87867 bytes=12816098 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=107497 bytes=16573614 [ASSURED] mark=0 use=1 conntrack v0.9.14 (conntrack-tools): 2 flow entries have been shown. root@titan ~# cat /proc/sys/net/netfilter/nf_conntrack_count 4096 root@titan ~# ./conntrack -S entries 4096 searched 2525930 found 418064263 new 295548 invalid 1509 ignore 233351 delete 291452 delete_list 280256 insert 280258 insert_failed 0 drop 69960 early_drop 173185 icmp_error 45 expect_new 0 expect_create 0 expect_delete 0 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
