conntrack error

Hi,
I encountered the following situation - when there are around 20000 connections "cat /proc/net/ip_conntrack" doesn't display all connections and outputs "cat: No space left on device" error. If I patch kernel with POM and 'nth' module (only patch, don't load the module) the same happens around 17000 connections. It happenes both with 2.6.9 and 2.6.10 kernels.

Why is it so? Is this matter of memory limit or something else?

Quoted 7 lines · Piotrek Kaczmarek

Hi,
I encountered the following situation - when there are around 20000 connections "cat /proc/net/ip_conntrack" doesn't display all connections and outputs "cat: No space left on device" error. If I patch kernel with POM and 'nth' module (only patch, don't load the module) the same happens around 17000 connections. It happenes both with 2.6.9 and 2.6.10 kernels.

Quoted 1 line

Why is it so? Is this matter of memory limit or something else?

what does:

sysctl net.ipv4.netfilter.ip_conntrack_max

say? i don't suppose it would be quite that simple, but might as well start there.

# sysctl net.ipv4.netfilter.ip_conntrack_max
net.ipv4.netfilter.ip_conntrack_max = 30000

Quoted 2 lines · Piotrek Kaczmarek

# sysctl net.ipv4.netfilter.ip_conntrack_max
net.ipv4.netfilter.ip_conntrack_max = 30000

i assume you set that manually, as i don't think there's an amount of physical RAM that would result in 30000 on the dot... speaking of which--how much physical RAM does this machine have? you would need 512 MB RAM for ip_conntrack_max to be automatically calculated to 32768, even though the conntrack table would only really use around 12 MB of kernel memory. also--is this machine dedicated solely to firewalling, or is there something else chewing up your RAM?