<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi, I have a high openvz performance node with ~20k/s packet rate .
I see this error almost constantly in kernel log and syslog:<br>
<br>
nf_conntrack: table full, dropping packet<br>
<br>
I have increased nf_conntrack_max values, by current usage i always
well below the limit (9999999)<br>
<br>
# /sbin/sysctl net.netfilter.nf_conntrack_count<br>
net.netfilter.nf_conntrack_count = 95020<br>
<br>
I checked the source code:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<span style="color: rgb(54, 54, 54); font-family: 'Helvetica Neue',
Helvetica, Arial, sans-serif; font-size: 12.800000190734863px;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: pre-wrap; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 0); display: inline !important;
float: none; ">if (nf_conntrack_max &&
unlikely(atomic_read(&net->ct.count) >
nf_conntrack_max)) { unsigned int hash = hash_conntrack(orig); if
(!early_drop(net, hash)) { atomic_dec(&net->ct.count); if
(net_ratelimit()) printk(KERN_WARNING "nf_conntrack: table full,
dropping" " packet.\n"); return ERR_PTR(-ENOMEM); } }</span><br>
<br>
I then set to nf_conntrack_max to 0 and I still get the dropped
packets, which is expected given the first line of the code above.<br>
<br>
I have not seen this on other Linux Kernels, although I have not
tested this exact case on non openvz kernel (the vms are doing the
traffic). Do you think this could be openvz specific? Should I boot
this to kernel list? Below is info demonstrating my issue.<br>
<br>
Thank you<br>
Rick<br>
<br>
<br>
#dmesg -c<br>
# find /proc -name nf_conntrack_max<br>
/proc/sys/net/netfilter/nf_conntrack_max<br>
/proc/sys/net/nf_conntrack_max<br>
cat /proc/sys/net/nf_conntrack_max<br>
0<br>
cat /proc/sys/net/netfilter/nf_conntrack_max<br>
0<br>
dmesg ; sleep 60<br>
dmesg | tail -5<br>
[248438.700906] nf_conntrack: table full, dropping packet.<br>
[248438.833028] nf_conntrack: table full, dropping packet.<br>
[248438.833289] nf_conntrack: table full, dropping packet.<br>
[248438.840900] nf_conntrack: table full, dropping packet.<br>
[248438.857631] nf_conntrack: table full, dropping packet.<br>
[248438.991957] nf_conntrack: table full, dropping packet.<br>
<br>
[root@enterprise linux-2.6.32]# uname -a<br>
Linux 2.6.32-042stab062.2 #1 SMP Wed Oct 10 18:28:35 MSK 2012 x86_64
x86_64 x86_64 GNU/Linux<br>
[root@enterprise linux-2.6.32]# <br>
<br>
<br>
</body>
</html>