nf_conntrack operates at Layer 3 and supports both IPv4 and IPv6, whereas ip_conntrack only supports IPv4.
Currently, most ip_conntrack_* entries have been replaced by nf_conntrack_*, and many ip_conntrack_* are merely aliases. The original ip_conntrack path at /proc/sys/net/ipv4/netfilter/ still exists, but the new nf_conntrack resides in /proc/sys/net/netfilter/. This is likely kept for backward compatibility:
$ pwd
/proc/sys/net/ipv4/netfilter$ ls
ip_conntrack_buckets ip_conntrack_tcp_loose ip_conntrack_tcp_timeout_syn_recv
ip_conntrack_checksum ip_conntrack_tcp_max_retrans ip_conntrack_tcp_timeout_syn_sent
ip_conntrack_count ip_conntrack_tcp_timeout_close ip_conntrack_tcp_timeout_syn_sent2
ip_conntrack_generic_timeout ip_conntrack_tcp_timeout_close_wait ip_conntrack_tcp_timeout_time_wait
ip_conntrack_icmp_timeout ip_conntrack_tcp_timeout_established ip_conntrack_udp_timeout
ip_conntrack_log_invalid ip_conntrack_tcp_timeout_fin_wait ip_conntrack_udp_timeout_stream
ip_conntrack_max ip_conntrack_tcp_timeout_last_ack
ip_conntrack_tcp_be_liberal ip_conntrack_tcp_timeout_max_retrans
$ pwd
/proc/sys/net/netfilter$ ls
nf_conntrack_acct nf_conntrack_tcp_timeout_close
nf_conntrack_buckets nf_conntrack_tcp_timeout_close_wait
nf_conntrack_checksum nf_conntrack_tcp_timeout_established
nf_conntrack_count nf_conntrack_tcp_timeout_fin_wait
nf_conntrack_events nf_conntrack_tcp_timeout_last_ack
nf_conntrack_events_retry_timeout nf_conntrack_tcp_timeout_max_retrans
nf_conntrack_expect_max nf_conntrack_tcp_timeout_syn_recv
nf_conntrack_generic_timeout nf_conntrack_tcp_timeout_syn_sent
nf_conntrack_icmp_timeout nf_conntrack_tcp_timeout_time_wait
nf_conntrack_log_invalid nf_conntrack_tcp_timeout_unacknowledged
nf_conntrack_max nf_conntrack_udp_timeout
nf_conntrack_tcp_be_liberal nf_conntrack_udp_timeout_stream
nf_conntrack_tcp_loose nf_log/
conntrack_tcp_max_retrans
Check current connection count:# grep ip_conntrack /proc/slabinfo
ip_conntrack 38358 64324 304 13 1 : tunables 54 27 8 : slabdata 4948 4948 216
Find out the current ip_conntrack ranking:$ cat /proc/net/ip_conntrack | cut -d ' ' -f 10 | cut -d '=' -f 2 | sort | uniq -c | sort -nr | head -n 10
nf_conntrack/ip_conntrack is related to NAT and is used to track connection entries. It uses a hash table to record established records. nf_conntrack was introduced in 2.6.15, and ip_conntrack was removed in 2.6.22. If this hash table becomes full, the following error appears:
nf_conntrack: table full, dropping packet
Here are several approaches to resolve this issue.
1. Disable the nf_conntrack module
First, remove the state module, because using it requires loading nf_conntrack. Ensure there are no rules in iptables that use the state module. If there are, remove them:
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
Comment out the following in /etc/sysconfig/iptables-config:
IPTABLES_MODULES="ip_conntrack_netbios_ns"
Remove the nf_conntrack module:$ sudo modprobe -r xt_NOTRACK nf_conntrack_netbios_ns nf_conntrack_ipv4 xt_state
$ sudo modprobe -r nf_conntrack
Now, there should be no nf_conntrack under /proc/net/.
2. Adjust parameters under /proc/
You can increase the conntrack entries (sessions, connection tracking entries) CONNTRACK_MAX or increase the size of the hash table storing conntrack entries HASHSIZE.
By default, CONNTRACK_MAX and HASHSIZE are calculated based on system memory to a reasonably suitable value:
For CONNTRACK_MAX, the formula is:
CONNTRACK_MAX = RAMSIZE (in bytes) / 16384 / (ARCH / 32)
For example, a 64-bit machine with 48G of memory can handle 48*1024^3/16384/2 = 1,572,864 netfilter connections simultaneously. For systems with more than 1G of memory, the default CONNTRACK_MAX is 65535.
For HASHSIZE, the default conversion relationship is:
CONNTRACK_MAX = HASHSIZE * 8
This means each linked list has an average of 8 conntrack entries. Its actual calculation formula is:
HASHSIZE = CONNTRACK_MAX / 8 = RAMSIZE (in bytes) / 131072 / (ARCH / 32)
For example, a 64-bit machine with 48G of memory can store 48*1024^3/131072/2 = 196,608 buckets (connection lists). For systems with more than 1G of memory, the default HASHSIZE is 8192.
You can directly modify the current system’s CONNTRACK_MAX and HASHSIZE values via echo:$ sudo su -c "echo 100000 > /proc/sys/net/netfilter/nf_conntrack_max"
$ sudo su -c "echo 50000 > /proc/sys/net/netfilter/nf_conntrack_buckets"
You can also shorten the timeout value:$ sudo su -c "echo 600 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established"
3. Use the raw table to bypass connection tracking
The raw table in iptables is related to packet tracking and is basically used for one thing: marking packets that do not need to be tracked via NOTRACK. That is, if a connection encounters -j NOTRACK, conntrack will not track that connection. The raw table has a higher priority than mangle, nat, and filter, and includes PREROUTING and OUTPUT chains.
When executing -t raw, the system automatically loads the iptable_raw module (if the module exists). The raw table was not available in 2.4 and early 2.6 kernels unless patched, but current systems should all support it:$ sudo iptables -A FORWARD -m state --state UNTRACKED -j ACCEPT
$ sudo iptables -t raw -A PREROUTING -p tcp -m multiport --dport 80,81,82 -j NOTRACK
$ sudo iptables -t raw -A PREROUTING -p tcp -m multiport --sport 80,81,82 -j NOTRACK
Of the three methods above, the most effective are 1 and 3. The second is merely a temporary fix, not a permanent solution.
ref:
http://www.digipedia.pl/usenet/thread/16263/7806/
http://serverfault.com/questions/72366/how-do-i-disable-the-nf-conntrack-kernel-module-in-centos-5-3-without-recompilin