Re: nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count

[Patrick McHardy <kaber@trash.net>]

Afi Gjermund wrote:
> Hi all,
> 
> I am running into an odd issue where the kernel begins to drop packets
> because the connection tracking table is full. (I am running
> 2.6.26.5).
> 
> A 'cat /proc/sys/net/netfilter/nf_conntrack_count' says 4096.  But if
> I do a 'cat /proc/net/nf_conntrack | wc -l' then it says 4.
> 
> A tail on /var/log/messages has:
> 
> Feb 15 16:45:33 titan user.warn kernel: __ratelimit: 20 messages suppressed
> Feb 15 16:45:33 titan user.warn kernel: nf_conntrack: table full,
> dropping packet.
> 
> I have an interface that allows me to do a 'nf_conntrack_flush' in
> kernel, but that seems to only clear the table of
> /proc/net/nf_conntrack and not the count the kernel has.
> 
> I need a way to ensure that at say 95% there is a way to clear the
> "actual" table as well as the count...whichever that may be.  There
> seems to be a disconnect between the implementation versus my
> understanding of how the system is working. Any help is appreciated.

Conntracks might exist and not be in the global table anymore,
f.i. when referenced by a packet. The difference in your case
seems pretty extreme, so I'd guess that packets are leaked
somewhere.