Re: ip_conntrack_max vs ip_conntrack

[Michal Ludvig <mludvig@suse.cz>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stephen J Smoogen told me that:
> Michal Ludvig wrote:
> 
>> Hi all,
>>
>> could someone please explain me what is the relation between the number
>> in /proc/sys/net/ipv4/ip_conntrack_max and number of lines in
>> /proc/net/ip_conntrack?
>>
>> On one of our very loaded firewalls (with 1GB RAM) we are still getting
>> "ip_conntrack: table full, dropping packet." message. We tried to tweak
>> all different parameters, e.g. hashsize to up to 1048576,
>> ip_conntrack_max, ip_conntrack_tcp_timeout_established, etc.
>> Unfortunately sooner or later the kernel always starts dropping packets.
>> At the same time however there are at most a few thousands of lines in
>> /proc/net/ip_conntrack.
>>
>> I instrumented the kernel to dump the same output via printk() once
>> ip_conntrack_count reaches ip_conntrack_max. When I set _max=128 and run
>> nmap through the firewall it of course very soon prints the "dropping
>> packets" message, but along with only 6 (=six!) lines of connections.
>> Where was the rest, 122 connections, lost? What does the
>> ip_conntrack_count actually count?
> 
> Ok one thing you might want to do is check to see if you dont have a bug
> in your kernel somewhere.. I found the one I talked about earlier by
> doing the following:
> 
> cat /proc/slabinfo |grep ip_conntrack
> cat /proc/net/ip_conntrack | wc -l
> 
> Not the best and very racy.. but the 2 did NOT match up in any shape or
> form. I then played around with various conntrack modules until I figure
> d it out to being something with conntrack_irc and conntrack_ftp in the
> kernel I was running. Removing those allowed for the 2 to match up
> closely when doing  HTTP crashloads on the firewall. Adding either one
> of them caused what looked like a resource leak.
> 
> As far as I can tell.. a POM-only patched 2.4.26 did not exhibit this
> problem.

I can see it on 2.6.5 but not on 2.6.9-rc2. Does anyone have the patch
or the cset number that fixed this? I hope I won't have to binary search
for it... ;-)

Michal Ludvig
- --
SUSE Labs                    mludvig@suse.cz
(+420) 296.542.396        http://www.suse.cz
Personal homepage http://www.logix.cz/michal
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBW9kTDDolCcRbIhgRAl3MAJ9T3SH/leXz3v4oScV/j4Q9vS6BggCfTFOh
WhXvdntlqi2W1bIs0o4E6as=
=48El
-----END PGP SIGNATURE-----