Comments on: Linux Iptables ip_conntrack: table full, dropping packet error and solution

By: d0r

d0r — Sat, 03 Apr 2010 21:52:04 +0000

[root@host4 ~]# wc -l /proc/net/ip_conntrack
65143 /proc/net/ip_conntrack

mhh… seems there is a limit of the max. conntrack value.
of course i have done sysctl -p and done restarts etc., but it dont help.

By: d0r

d0r — Sat, 03 Apr 2010 21:49:55 +0000

my server has 16 gb ram – i am hosting some VPS.
one of the VPS is under syn ddos, the limit of conntrack is already at 300000 but the table is still full.
i can set the limit to 3000000 and the table is always full.

actually i use:
net.ipv4.netfilter.ip_conntrack_max = 9527600
net.ipv4.ip_conntrack_max = 9527600

OS: centos 5

is there a limit of max. conntrack value?

thanks!

By: Georgi Georgiev

Georgi Georgiev — Sat, 07 Mar 2009 01:45:15 +0000

Thanks!
It works for me too – I love you :)

By: OQiis co.

OQiis co. — Wed, 12 Nov 2008 02:44:29 +0000

So nice solution.

Regards.
Eng. Mahmoud Al Sayed.

By: we3cares

we3cares — Tue, 23 Sep 2008 04:16:14 +0000

Very Nice Article……..

Like it….. :)

By: vivek

vivek — Sat, 12 Jan 2008 15:42:42 +0000

blink4blog,

Above instructions must work on Suse Linux.

By: blink4blog

blink4blog — Sat, 12 Jan 2008 15:30:22 +0000

How about SuSEFirewall2? Are there any similar way to do the same? Thanks