Jesper Dangaard Brouer wrote: > On Fri, 23 Apr 2010, Patrick McHardy wrote: > >> That sounds like a good idea. But lets what for Jesper's test results >> before we start fixing this problem :) > > I will first have time to perform the tests Monday or Tuesday. > > BUT I have just noticed there seems to be a corrolation between > conntrack early_drop and searches. I have upload a new graph: > > http://people.netfilter.org/hawk/DDoS/2010-04-12__001/conntrack_early_drop002.png I guess that's somewhat expected when your conntrack table is full and all you're seeing is new connection setup attempts. First you have a search for an existing conntrack, then it attempts to create a new one and tries to early_drop and old one. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
