Error Cause:
The command: netstat -nat|grep -i “80″|wc -l
#netstat -nat|grep -i “80″|wc -l
netstat -an prints the current network link status of the system, while grep -i “80″ extracts connections related to port 80, and wc -l counts the number of connections.
#netstat -nat|grep -i “80″|wc -l
netstat -an prints the current network link status of the system, while grep -i “80″ extracts connections related to port 80, and wc -l counts the number of connections.
less /proc/net/ip_conntrack |wc -l counts the lines to get the number of transmitted packets. The following method is simpler:
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count directly views the statistics count without needing to count the lines of /proc/net/ip_conntrack
For machines acting as a gateway with NAT enabled, /proc/net/ip_conntrack stores the connection status between internal and external addresses, recording the details of each connection. Its contents are generally kept for 5 days. Restarting the network during this period does not effectively reduce its content. The only solutions are to reboot the system or increase the memory size, which causes inconvenience for monitoring. The table can easily become full, triggering kernel alerts.
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count directly views the statistics count without needing to count the lines of /proc/net/ip_conntrack
For machines acting as a gateway with NAT enabled, /proc/net/ip_conntrack stores the connection status between internal and external addresses, recording the details of each connection. Its contents are generally kept for 5 days. Restarting the network during this period does not effectively reduce its content. The only solutions are to reboot the system or increase the memory size, which causes inconvenience for monitoring. The table can easily become full, triggering kernel alerts.
Solutions:
1. Modify: echo 655360 > /proc/sys/net/ipv4/ip_conntrack_max
echo 180 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established
echo 180 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established
Or modify /etc/sysctl.conf:
net.ipv4.ip_conntrack_max = 655360
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 180
Then run sysctl -p to make it effective
net.ipv4.ip_conntrack_max = 655360
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 180
Then run sysctl -p to make it effective
2. Periodically restart the system or firewall to clear ip_conntrack, e.g., service iptables restart;
3. ulimit -n 81920 This command must be run as root and only within a bash shell. It does not require a machine reboot, but becomes invalid after a reboot.
Slow network speed is not directly related to the maximum number of connections; many P2P programs heavily use UDP, which proves this.
3. ulimit -n 81920 This command must be run as root and only within a bash shell. It does not require a machine reboot, but becomes invalid after a reboot.
Slow network speed is not directly related to the maximum number of connections; many P2P programs heavily use UDP, which proves this.
IP_conntrack refers to the connection tracking database (conntrack database). Each tracked connection table entry occupies 350 bytes of kernel storage space. Over time, the default space can fill up. What is the default space size? Generally, on Red Hat machines with 64MB of RAM, it is 4096; with 128MB of RAM, it is 8192; and with 256MB of RAM, it is 16376.
The above information is sourced from online materials. Now, I will analyze the situation based on the issue I encountered.
Our server’s kernel has been upgraded to 2.6.30.1, so the solution differs and the file paths have changed.
My error message is as follows:
kernel: nf_conntrack: table full, dropping packet. This error keeps repeating.
Solution:
#echo 1048576 >/proc/sys/net/netfilter/nf_conntrack_max
#echo 1048576 >/proc/sys/net/nf_conntrack_max
Then write it into the /etc/rc.local file to ensure it takes effect automatically after booting.
#echo 1048576 >/proc/sys/net/nf_conntrack_max
Then write it into the /etc/rc.local file to ensure it takes effect automatically after booting.