Re: connection tracking and kernel dropping packets

[Florian Westphal <fw@strlen.de>]

Matt Zagrabelny <mzagrabe@d.umn.edu> wrote:
> On Tue, Oct 29, 2024 at 10:48 AM Slavko <linux@slavino.sk> wrote:
> >
> > Dňa 29. októbra 2024 15:11:34 UTC používateľ Matt Zagrabelny <mzagrabe@d.umn.edu> napísal:
> >
> > >...but it is still dropping packets due to the CT.
> >
> > You have first to inspect what is filling your conntrack table:
> >
> >     conntrack -L
> 
> I've waited a week to let the TCP streams in the conntrack table time
> out. I'm still seeing the kernel drop packets:

conntrack -F not working?

> # tail -f /var/log/kern.log
> Nov  6 11:29:02 netadm kernel: [48773744.961053] nf_conntrack: table
> full, dropping packet.
> 
> ...and confirmed with /proc:
> 
> # cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count
> 65536
> 
> ...but there aren't that many flows in the conntrack table, and none
> in the expect table.
> 
> # conntrack -L > /dev/null
> conntrack v1.2.1 (conntrack-tools): 22 flow entries have been shown.

Depending on userspace/kernel version this may only list ipv4.

> Any idea where to find what is still causing the kernel to drop packets?
> 
> I still need to handle the INVALID state, but here is my current rule-set:
> 
> # Generated by iptables-save v1.4.14 on Wed Nov  6 11:40:00 2024
> *raw
> :PREROUTING ACCEPT [559078817:46637850935]
> :OUTPUT ACCEPT [539455981:114717831525]
> [311121010:22258566347] -A PREROUTING -p udp -m udp --dport 53 -j CT --notrack
> [82158007:15791189816] -A PREROUTING -p udp -m udp --sport 53 -j CT --notrack
> [160638557:7854716900] -A PREROUTING -p tcp -m tcp --dport 53 -j CT --notrack
> [55174:13694242] -A PREROUTING -p tcp -m tcp --sport 53 -j CT --notrack
> [82898530:7187312985] -A OUTPUT -p udp -m udp --dport 53 -j CT --notrack
> [310815684:92319143568] -A OUTPUT -p udp -m udp --sport 53 -j CT --notrack
> [81356:4991618] -A OUTPUT -p tcp -m tcp --dport 53 -j CT --notrack
> [134221259:13321766219] -A OUTPUT -p tcp -m tcp --sport 53 -j CT --notrack
> COMMIT

Is this an ipv4 only system?