Hi netfilter, I encountered strange kernel crush using ebtables, and did not find any clue. Our cluster keep crushing so please shed light on me if somebody has some exprience. Current our environment is - ubuntu xenial kernel 4.13 - openstack stein - ebtables version 3.10 >From today, we even does not know what makes crush since there was no any log (literally kernel, application or something) Only that we encounter is when linux bridge agent in openstack restarted, server reboot without any log. After reboot, we see strange null string (@) in syslog. (Google says it kernel failed to write file because of unknown crush but no detail) We tracked what excutable makes crush using bcc execsnoop, and finally find ebtables! To be sure, I just ran simply 'ebtables -t nat -L' , surprisingly it do make panic just like before. More hints to consider - We run the command over 400 computes and only 10% (about 40 servers) crushed - After crush, server never crushed anymore with same command - We never used ebtables command, so there were no rules. Ebtables module itself insmoded but not ebtables_nat . I dig ebtables client and kernel module codebases, but from my knowledges I could not fund which can make panic possibly. Does anybody can guide how netfilter make crush? We are so desperate to find clues so any help will be really appreciated. Thanks
