-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stephen J Smoogen told me that: > Michal Ludvig wrote: > >> Hi all, >> >> could someone please explain me what is the relation between the number >> in /proc/sys/net/ipv4/ip_conntrack_max and number of lines in >> /proc/net/ip_conntrack? >> >> On one of our very loaded firewalls (with 1GB RAM) we are still getting >> "ip_conntrack: table full, dropping packet." message. We tried to tweak >> all different parameters, e.g. hashsize to up to 1048576, >> ip_conntrack_max, ip_conntrack_tcp_timeout_established, etc. >> Unfortunately sooner or later the kernel always starts dropping packets. >> At the same time however there are at most a few thousands of lines in >> /proc/net/ip_conntrack. >> >> I instrumented the kernel to dump the same output via printk() once >> ip_conntrack_count reaches ip_conntrack_max. When I set _max=128 and run >> nmap through the firewall it of course very soon prints the "dropping >> packets" message, but along with only 6 (=six!) lines of connections. >> Where was the rest, 122 connections, lost? What does the >> ip_conntrack_count actually count? > > Ok one thing you might want to do is check to see if you dont have a bug > in your kernel somewhere.. I found the one I talked about earlier by > doing the following: > > cat /proc/slabinfo |grep ip_conntrack > cat /proc/net/ip_conntrack | wc -l > > Not the best and very racy.. but the 2 did NOT match up in any shape or > form. I then played around with various conntrack modules until I figure > d it out to being something with conntrack_irc and conntrack_ftp in the > kernel I was running. Removing those allowed for the 2 to match up > closely when doing HTTP crashloads on the firewall. Adding either one > of them caused what looked like a resource leak. > > As far as I can tell.. a POM-only patched 2.4.26 did not exhibit this > problem. I can see it on 2.6.5 but not on 2.6.9-rc2. Does anyone have the patch or the cset number that fixed this? I hope I won't have to binary search for it... ;-) Michal Ludvig - -- SUSE Labs mludvig@xxxxxxx (+420) 296.542.396 http://www.suse.cz Personal homepage http://www.logix.cz/michal -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFBW9kTDDolCcRbIhgRAl3MAJ9T3SH/leXz3v4oScV/j4Q9vS6BggCfTFOh WhXvdntlqi2W1bIs0o4E6as= =48El -----END PGP SIGNATURE-----
