Re: /proc/net/ip_conntrack filling without ipt_conntrack.o loaded?

[Filip Sneppe <filip.sneppe@cronos.be>]

On Tue, 2003-01-14 at 17:37, Christian Hammers wrote:

> Kernel-2.4.20. modprobe-2.4.15. Debian 3.0 woody distribution.
>
> > Is this reproducable upon every reboot ?
> I'm not allowed to reboot it :-) But it's still reproducible that 
> after decreasing with about 1000 per minute the value of
> /proc/net/ip_conntrack has now stabilized around the
> /proc/sys/net/ipv4/ipt_conntrack_max value which is currently 10000 
> (was 65520 and filled up to ca. 50000)

Since you haven't rebooted it, you will continue to have this
problem as basically your running kernel+ip_conntrack is
basically screwed until you reboot the box. 

> Hmm :) 
> Maybe you should set your machine unter a load of at least 4mbit/s 
> with random IPs. This was the amount of traffic my router had when I
> reloaded the firewall rule script with a "rmmod" at the beginning.

I think you're absolutely right that by unloading ip_conntrack
while the box is handling packets gives you a greater chance
of triggering a problem. I remember having this kind of problem
occasionally with NIC drivers and ip_conntrack_ftp.

See also this item on the netfilter TODO list:

TO BE INVESTIGATED:
[...]
- ip_conntrack rmmod loop (sometimes, Yan's patch?)
   
Could be your problem, couldn't it ?
Not a lot I can say to help you any further though...
If you can reproduce this, you may inform netfilter-devel
of your workload and test scenario, which could help
developers. Is your firewall an SMP (multiprocessor)
machine, by any chance ?

Regards,
Filip