Kernel syslog message 'nf_conntrack: table full, dropping, packet' is not correct because packet have just no state relatively to conntrack. Default maximum size is ridicully too low like using 20Mbytes oon a 12GB memory computer. When reaching the maximum, new connections are simply dropped. There is a fixed number of connection tracking entries. Author Regit Posted on 3 Categories Netfilter Tags NFWS Leave a comment on Holger Eitzenberger: speeding up selective conntrack flush Jesper Dangaard Brouer: the missing conntrack garbage collector The discussion is planned to continue during the way back to the hotel.

Other points were discussed like the fact that connection tracking could in someway react to this topology change. Holger wants to know if somebody has another solution for this problem (or if someone see generic usage of their features).ĭiscussion shows that the explanation of the slowness was the fact that conntrack-tools force you to delete connection one by one. They thus decide to put in kernel space and this is now only taking milliseconds instead of minutes. Without doing that the connection are not correctly NATed because the topology change has not been taken into account.ĭoing this in userspace with the conntrack-tools was taking long like minutes on some setup. For example this is the case when a ipsec or a ppp connection goes up. At times it is necessary to flush UNREPLIED connection tracking entries for connectionless protocols if there are NAT rules involved.

Sophos xg unreplied