Skip to contentSkip to conversation

ip_conntrack_max

DISCUSSION Fallucchi Antonio 5 participants 11 messages Jul 8, 2004

lore
Share & tools
lore

Fallucchi Antonio

author
#0 lore raw

hi

i have the problem width "ip_conntrack: table full, dropping packet."

what is the good and max dimension of the ip_conntrack_max ?

tanks.
bye

#1 lore raw
Quoted 5 lines · Fallucchi Antonio

hi

i have the problem width "ip_conntrack: table full, dropping packet."

what is the good and max dimension of the ip_conntrack_max ?

The answer to this depends on:

1. How many connections you need to support through your firewall.
2. How much memory you have in your machine (each connection table entry uses a small amount of memory, therefore this is what sets the limit on the maximum size you can make it on a given machine.

What is the output of "wc -l /proc/net/ip_conntrack", and how much memory do you have in your system?

Regards,

Antony.

Signature · 10 lines
In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

                                                     Please reply to the list;
                                                           please don't CC me.
author
#2 lore raw

Antony Stone wrote: On Thursday 08 July 2004 10:38 am, Fallucchi Antonio wrote: hi i have the problem width "ip_conntrack: table full, dropping packet." what is the good and max dimension of the ip_conntrack_max ?

#3 lore raw
Quoted 2 lines · Fallucchi Antonio

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html>

Oh, please don't post html to the list....

I'll edit the crap out of this so you can see my response, but I may not reply to other html emails....

Quoted 10 lines

Antony Stone wrote:

1. How many connections you need to support through your firewall.
2. How much memory you have in your machine (each connection table entry uses a small amount of memory, therefore this is what sets the limit on the maximum size you can make it on a given machine.

</blockquote>
the memory of my machie is 128 MB, I don't know how many connection I have need..<br>

128Mbytes should be enough for a few thousand connections. As for how many
do you need, a starting point is:

1. How any client computers do you have in your LAN accessing the Internet through the firewall? (allow a maximum of 10 connections per PC at any given time - this will be an overestimate, but not by a ridiculous factor).

2. Do you run any servers on your DMZ accessible from the Internet? Mail
servers, web servers, and name servers will all generate different volumes of connections, but if you allow 50-100 connections per server, again that should be a worthwhile estimate.

Quoted 6 lines

What is the output of "wc -l /proc/net/ip_conntrack", and how much memory do you have in your system?

</blockquote>
wc -l /proc/net/ip_conntrack<br>
&nbsp;&nbsp;&nbsp; 626 /proc/net/ip_conntrack<br>

In that case something is wrong with your system. 626 connections is hardly
anything - I do not see how you can be running out of conntrack table entries with only 626 current connections.

What is the value in /proc/sys/net/ipv4/ip_conntrack_max ?

Regards,

Antony.

Signature · 4 lines
Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.
author
#4 lore raw

Antony Stone wrote:

oh!, excuse me for the html!

Quoted 8 lines

128Mbytes should be enough for a few thousand connections. As for how many do you need, a starting point is:

1. How any client computers do you have in your LAN accessing the Internet through the firewall? (allow a maximum of 10 connections per PC at any given time - this will be an overestimate, but not by a ridiculous factor).

2. Do you run any servers on your DMZ accessible from the Internet? Mail servers, web servers, and name servers will all generate different volumes of connections, but if you allow 50-100 connections per server, again that should be a worthwhile estimate.

very well, thancks. I have 20 computer in the lan and 5 server.

Another questions: how I can limit the number of connection for every computer?

Quoted 6 lines

In that case something is wrong with your system. 626 connections is hardly anything - I do not see how you can be running out of conntrack table entries with only 626 current connections.

What is the value in /proc/sys/net/ipv4/ip_conntrack_max ?

ip_conntrack_max now is 10240.

bye
Antonio!

#5 lore raw
Quoted 3 lines · Fallucchi Antonio

Antony Stone wrote:

oh!, excuse me for the html!

Thanks for turning it off.

Quoted 1 line

I have 20 computer in the lan and 5 server.

In that case a 128Mbyte machine should have no trouble.

Quoted 2 lines

Another questions: how I can limit the number of connection for every computer?

This is difficult. I think we should start by asking "what do you mean by a
connection?" Remember that many web browsers, for example, will open 5-10
simultaneous connections in order to load all the elements of a web page.
DNS needs its own connections in order to do name lookups. Some connections
are long-term (eg: telnet, ssh - even when you're not typing, the connection is still there), some are very transient (eg: http - once you have the page displayed, there's no connection between your browser and the server until you click on another hyperlink).

Why do you want to limit connections per machine? What are you trying to
achieve?

Quoted 3 lines
Quoted 1 line

What is the value in /proc/sys/net/ipv4/ip_conntrack_max ?

ip_conntrack_max now is 10240.

That sounds fine. Tell us if you get "connection tracking table full" errors
again.

Regards,

Antony.

Signature · 7 lines
Success is a lousy teacher.  It seduces smart people into thinking they can't 
lose.

 - William H Gates III

                                                     Please reply to the list;
                                                           please don't CC me.
#6 lore raw
Quoted 11 lines

<>
This is difficult. I think we should start by asking "what do you mean by a connection?" Remember that many web browsers, for example, will open 5-10 simultaneous connections in order to load all the elements of a web page. DNS needs its own connections in order to do name lookups. Some connections are long-term (eg: telnet, ssh - even when you're not typing, the connection is still there), some are very transient (eg: http - once you have the page displayed, there's no connection between your browser and the server until you click on another hyperlink).

Thancks for the instruction..

Quoted 3 lines

<>Why do you want to limit connections per machine? What are you trying to achieve?

The problem are the P2P software that create any connection on the conntrack..
Because filter all p2p port is very difficult, I thought that to limit the number of simultaneous connection is a gooa idea..

Quoted 8 lines

That sounds fine. Tell us if you get "connection tracking table full" errors again.

Regards,

Antony.

Bye

ps: it's ok the signature now?

Signature · 7 lines
---------------------------------------------------------------
| |||||||    ||    |  Fallucchi Antonio Giuseppe  mat. 2282     |
| ||        ||||    |      --> Live free() of die() <--         |
| ||||     ||  ||    |        OpenSource philosophy             |
| ||      ||||||||    |  Universita' di Bologna sede di Cesena  |
| ||     ||      ||    |    Cdl di Scienze dell'Informazione    |
---------------------------------------------------------------
author
#7 lore raw
In reply to Antony Stone
Quoted 11 lines

This is difficult. I think we should start by asking "what do you mean by a connection?" Remember that many web browsers, for example, will open 5-10 simultaneous connections in order to load all the elements of a web page. DNS needs its own connections in order to do name lookups. Some connections are long-term (eg: telnet, ssh - even when you're not typing, the connection is still there), some are very transient (eg: http - once you have the page displayed, there's no connection between your browser and the server until you click on another hyperlink).

Thancks for the instruction..

Quoted 3 lines

<>Why do you want to limit connections per machine? What are you trying to achieve?

The problem are the P2P software that create any connection on the conntrack..
Because filter all p2p port is very difficult, I thought that to limit the number of simultaneous connection
is a gooa idea..

Quoted 8 lines

That sounds fine. Tell us if you get "connection tracking table full" errors again.

Regards,

Antony.

Bye

ps: it's ok the signature now?

Signature · 7 lines
 ---------------------------------------------------------------
| |||||||    ||    |  Fallucchi Antonio Giuseppe  mat. 2282     |
| ||        ||||    |      --> Live free() of die() <--         |
| ||||     ||  ||    |        OpenSource philosophy             |
| ||      ||||||||    |  Universita' di Bologna sede di Cesena  |
| ||     ||      ||    |    Cdl di Scienze dell'Informazione    |
 ---------------------------------------------------------------
#8 lore raw
Quoted 7 lines · Fallucchi Antonio
Quoted 2 lines

Why do you want to limit connections per machine? What are you trying to achieve?

The problem are the P2P software that create any connection on the conntrack..
Because filter all p2p port is very difficult, I thought that to limit the number of simultaneous connection is a good idea..

I think the right solution for this problem is to connect your internal users through proxy machines, so they can't do direct P2P connections at all.

What network connections do your users need? Email is SMTP / POP3 / IMAP to
a local server (or a single specified server at your ISP). HTTP / HTTPS /
FTP you can proxy very simply through Squid. DNS should be to a local
caching server only (on the same machine as Squid for good Squid
performance). If you need to allow SSH, then only allow it from one
specific machine on your network, which people have to connect through (and disable port forwarding).

I can't think of any other protocols you're likely to need, and this should stop all P2P activity as well as enhance the performance of your network by using a caching proxy server for the website which can be cached.

Quoted 1 line

ps: it's ok the signature now?

---------------------------------------------------------------

| |||||||    ||    |  Fallucchi Antonio Giuseppe  mat. 2282     |
| ||        ||||    |      --> Live free() of die() <--         |
| ||||     ||  ||    |        OpenSource philosophy             |
| ||      ||||||||    |  Universita' di Bologna sede di Cesena  |
| ||     ||      ||    |    Cdl di Scienze dell'Informazione    |

---------------------------------------------------------------

No, I don't quite think so - I think your want "or" instead of "of" in "Live free() or die()"?

Regards,

Antony.

Signature · 10 lines
"When you talk about Linux versus Windows, you're talking about which 
operating system is the best value for money and fit for purpose. That's a 
very basic decision customers can make if they have the information available 
to them. Quite frankly if we lose to Linux because our customers say it's 
better value for money, tough luck for us."

 - Steve Vamos, MD of Microsoft Australia

                                                     Please reply to the list;
                                                           please don't CC me.