HEEEEEEEEEELP!!!! with ip_conntrack: table full, dropping packet.

HEEEEEEEEEELP!!!! with ip_conntrack: table full, dropping packet.

[Pablo Vila]

I have the this problem, i have compiled and installed ok a new kernel 
(2.6.10)

 kernel: printk: 55 messages suppressed.
 kernel: ip_conntrack: table full, dropping packet.

and this message repeats a lot, but i never have this problem with kernel 
2.6.9-1-686, i have to compile a new one becouse i need suport for a new 
device scsi i have installed. but i can't fix this message and i don't know 
what is the problem.
Some info:
Proc: Celeron 333 Mhz
Mem: 256 Mb
if you need more info ask me!, thx to all!!!...

PS: Sorry my English
                                           Pablo <===

-------------------------------------------
  Pablo Francisco Vila Silveira     CX5CM
     email: pvila@montevideo.com.uy
            pvila@adinet.com.uy
       sms: 94338237@sms.bellsouth.com.uy
   Montevideo, Uruguay, America del Sur
------------------------------------------- 

Re: HEEEEEEEEEELP!!!! with ip_conntrack: table full, dropping packet.

[Christian Theil]

Hi

You should provide some information on your setup (eg. iptables rules,
is it a router/firewall or a host?). Im assuming you're talking about
a router...

First of all, do you need conntrack? If not, don't load the module...

If You do, You can use the connlimit to limit the number of connections
(for instance, pr. IP address). using the connlimit match. 

for instance if you wan't to limit the number of connections initiated
by an IP address on an internal network, by doing something like

iptables -A FORWARD -m connlimit -s 192.168.1.xxx --connlimit-above 10 -j DROP

Sincerely,
Christian

On Wed, 26 Jan 2005 19:54:30 -0200, Pablo Vila <pvila@adinet.com.uy> wrote:
> I have the this problem, i have compiled and installed ok a new kernel
> (2.6.10)
> 
>  kernel: printk: 55 messages suppressed.
>  kernel: ip_conntrack: table full, dropping packet.
> 
> and this message repeats a lot, but i never have this problem with kernel
> 2.6.9-1-686, i have to compile a new one becouse i need suport for a new
> device scsi i have installed. but i can't fix this message and i don't know
> what is the problem.
> Some info:
> Proc: Celeron 333 Mhz
> Mem: 256 Mb
> if you need more info ask me!, thx to all!!!...
> 
> PS: Sorry my English
>                                            Pablo <===
> 
> -------------------------------------------
>   Pablo Francisco Vila Silveira     CX5CM
>      email: pvila@montevideo.com.uy
>             pvila@adinet.com.uy
>        sms: 94338237@sms.bellsouth.com.uy
>    Montevideo, Uruguay, America del Sur
> -------------------------------------------
> 
>

Re: HEEEEEEEEEELP!!!! with ip_conntrack: table full, dropping packet.

[Samuel Jean]

On Wed, January 26, 2005 4:54 pm, Pablo Vila said:
> I have the this problem, i have compiled and installed ok a new kernel
> (2.6.10)
>
>  kernel: printk: 55 messages suppressed.
>  kernel: ip_conntrack: table full, dropping packet.

This is a bug introduced in 2.6.10 and fixed in current tree.
Please see this thread:
https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017908.html

>[...]
>
> PS: Sorry my English
>                                            Pablo <===
>
> -------------------------------------------
>   Pablo Francisco Vila Silveira     CX5CM
>      email: pvila@montevideo.com.uy
>             pvila@adinet.com.uy
>        sms: 94338237@sms.bellsouth.com.uy
>    Montevideo, Uruguay, America del Sur
> -------------------------------------------
>
>

Regards,

Samuel