Re: ip_conntrack table full problem

[Phil Oester <kernel@linuxace.com>]

On Mon, Mar 21, 2005 at 06:03:18PM +0100, Thomas Jarosch wrote:
> > Yes, you're leaking conntracks somewhere.  Any possibility of testing
> > a somewhat newer kernel than 2.4.21?  This may have already been
> > fixed.
> 
> Thank you for your response.
> Unfortunately I cannot update to a newer kernel soon.
> 
> Would it be possible to dump the internal conntrack tables
> once the error occurs? Then we would at least know what
> is filling the table up. Is there some kind of debug macro
> I could add before the printk("conntrack table full") code?

No easy way.  Last week I posted a patch which would have made
this possible by creating a 'cleaned' list, but since you cannot
upgrade kernels, you could not use this anyway.

> Or a more aggressive solution:
> Flush the complete conntrack table once the error occurs.
> This would kill all running connections, but the machine
> would still be reachable afterwards.

Even if conntrack were modular, you would be unable to unload
it (see the thread referenced above).

> Any other ideas?

I'm still studying the root cause and have narrowed it down
somewhat, but no patch yet.

> I'll try to reproduce the problem in a test environment,
> but it will be hard to narrow the cause down.

What's the traffic pattern on this box?  In my testing I've
never seen such high rates of leakage.

Phil