Kernel:ip_conntrack:table full, dropping packet

Original paste: http://my.icxo.com/254747/viewspace-47172.html

Today, there is a download server problem, packet loss is very serious, restart after looking at the system log, a lot of "kernel:ip_conntrack:table full, dropping packet."

Online search for a moment, with hping solution download hping:
Http://www.hping.org/download.html

./configure
Make
Make install

Write a script after installation.

Code:

#!/bin/bash

Echo
echo "############################"
echo "# Edit by Youngh 2003.06.24 v1.1"
echo "# Usage:clr_conns IPAddress"
echo "# This'll clear all connections from this ip_address"
echo "# Example:/root/clr_conns 10.0.3.3"
echo "############################"
Echo

If [-Z $]; Then
Exit
Fi

Grep-e "^tcp. {10,25} Established src=$1 "/proc/net/ip_conntrack | while read line; Todo
S_ip= ' echo $line | awk ' {print substr ($5,5)} '
S_sock= ' echo $line | awk ' {print substr ($7,7)} '
D_ip= ' echo $line | awk ' {print substr ($6,5)} '
D_sock= ' echo $line | awk ' {print substr ($8,7)} '
echo "$S _ip: $S _sock $D _ip: $D _sock"

Hping2 $D _ip-r-S $S _sock-p $D _sock-a $S _ip-k-C 1 >/dev/null 2>/dev/null &

Done
Save As Clr_conns.sh

Use:

SH clr_conns.sh x.x.x.x

You can clear the displayed connection.

Excerpt from: China Linux Forum

View Ip_conntrack First few IP

Cat/proc/net/ip_conntrack | Cut-d '-F 10 | cut-d ' = '-F 2 | Sort | uniq-c | Sort-nr | Head-n 5

Http://blog.csdn.net/zhy97031/archive/2007/07/12/1686598.aspx

Excerpt from Iptables guide 1.1.19
When a connection has a transmission in two directions, the Conntrack record deletes the [unreplied] flag and resets it. A record at the end of [assured] indicates that there is no traffic in either direction. Such records are determined and will not be deleted when the connection tracking table is full, and no [assured] records will be deleted. How many records the connection tracking table can hold is controlled by a variable that can be set by the IP-SYSCTL function in the kernel. The default value depends on the size of your memory, 128MB can contain 8,192 directories, 256MB is 16,376. You can also view and set it in/proc/sys/net/ipv4/ip_conntrack_max.
Like:
[Root@mailserver root]# Sysctl-a|grep Conntrack_max
Net.ipv4.ip_conntrack_max = [Color=red]65528[/color]
[Root@mailserver root]# Free
[color=red] total[/color] used free shared buffers Cached
Mem: [color=red]1027724 [/color] 1016160 11564 208 151676 767880
-/+ buffers/cache:96604 931120
swap:1024056 0 1024056

-------------------------------------------------------------------------------------------------