Linux Cloud Host CPU has been very high down, syslog report nf_conntrack:table full, dropping packet.

The following error often occurs when traffic is high on a iptables Web server that is enabled:

Ip_conntrack:table full, dropping packet

The cause of this problem is because the Web server received a large number of connections, in the case of iptables enabled, Iptables will all the connections are linked tracking processing, so that iptables will have a link tracking table, when the table full, the above error will occur.

Iptables's Link Tracking table has a maximum capacity of/proc/sys/net/ipv4/ip_conntrack_max, which is removed from the table when the link encounters a timeout in various states.

So there are two ways of solving this:

(1) Increase Ip_conntrack_max value

Vi/etc/sysctl.conf

Net.ipv4.ip_conntrack_max = 393216
Net.ipv4.netfilter.ip_conntrack_max = 393216

(2) Restricted by iptable

Iptables-a input-m State--state untracked-j Accept--no link to status tracking allows access

Parameter-M State--state
Example Iptables-a input-m State--state related,established
The description is used to compare online status to four types of online status: INVALID, established, NEW, and related.

INVALID indicates that the packet's online number (Session ID) is not recognizable or is incorrectly numbered.
Established indicates that the packet belongs to an already established online.
NEW indicates that the package wants to start one online (reset online or redirect online).
Related indicates that the package belongs to an already established online, and that the new online is established. For example, Ftp-data online must originate from an FTP online.

Linux Cloud Host CPU has been very high down, syslog report nf_conntrack:table full, dropping packet.