Linux Iptables ip_conntrack: table full, dropping packet error and solution

by Vivek Gite · 5 comments

My Red hat Enterprise Linux 5 server reporting the following message in /var/log/messages (syslog):

ip_conntrack: table full, dropping packet.

How do I fix this error?

A. If you notice the above message in syslog, it looks like the conntrack database doesn't have enough entries for your environment. Connection tracking by default handles up to a certain number of simultaneous connections. This number is dependent on you system's maximum memory size.

You can easily increase the number of maximal tracked connections, but be aware that each tracked connection eats about 350 bytes of non-swappable kernel memory!

To print current limit type:
# sysctl net.ipv4.netfilter.ip_conntrack_max
Output:

8192

To increase this limit to e.g. 12000, type:
# sysctl -w net.ipv4.netfilter.ip_conntrack_max=12000
Alternatively, add the following line to /etc/sysctl.conf file:
net.ipv4.netfilter.ip_conntrack_max=12000
The following will tell you how many sessions are open right now:
# wc -l /proc/net/ip_conntrack
Output:

5000 /proc/net/ip_conntrack

Featured Articles:

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 5 comments… read them below or add one }

1 blink4blog 01.12.08 at 3:30 pm

How about SuSEFirewall2? Are there any similar way to do the same? Thanks

2 vivek 01.12.08 at 3:42 pm

blink4blog,

Above instructions must work on Suse Linux.

3 we3cares 09.23.08 at 4:16 am

Very Nice Article……..

Like it….. :)

4 OQiis co. 11.12.08 at 2:44 am

So nice solution.

Regards.
Eng. Mahmoud Al Sayed.

5 Georgi Georgiev 03.07.09 at 1:45 am

Thanks!
It works for me too – I love you :)

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous FAQ:

Next FAQ:

nixCraft FAQ PDF Collection Now Available To All