Re[2]: [LARTC] Connection Tracking - How Many???

Re[2]: [LARTC] Connection Tracking - How Many???

[Peteris Krumins]

Thursday, September 25, 2003, 10:35:39 PM, you wrote:

WDW> Sorry, I must have missed it when reading the netfilter howto. I
WDW> found it later when reading through it again: approx 32,000 connections
WDW> per 512 megs of ram.

Wrong.
1 conntrack entry = 292 Bytes.
512*1024 = 524800 KiloBytes
524800*1024 = 537395200 Bytes

537395200 / 292  = 1840394 connections.

Of course this would simply kill the cpu.
I am doing 35000 connection trackings at the moment at
aprox. less than 80mb of ram on 266Mhz PII..


P.Krumins

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: Re[2]: [LARTC] Connection Tracking - How Many???

[Daniel Chemko]

292 Bytes: Is that for just 'IP' CONNTRACKS, or is that for 'IP/TCP' and
'IP/UDP' tracking? I see them storing a lot more information for any
tracking of Layer 7 protocols, etc..

Example: 
FTP uses a structure called ip_ct_ftp_expect which is created for every
FTP session created. It stores 10 bytes. This might not be that large
compared to the rest of the conntrack, but I can see that more complex
protocols could add quite a bit more.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: Re[2]: [LARTC] Connection Tracking - How Many???

[Walter D. Wyndroski]

From the documentation links on www.netfilter.org -->
http://iptables-tutorial.frozentux.net/iptables-tutorial.html

How many connections that the connection tracking table can hold depends
upon a variable that can be set through the ip-sysctl functions in recent
kernels. The default value held by this entry varies heavily depending on
how much memory you have. On 128 MB of RAM you will get 8192 possible
entries, and at 256 MB of RAM, you will get 16376 entries. You can read and
set your settings through the /proc/sys/net/ipv4/ip_conntrack_max setting.

Walt


----- Original Message ----- 
From: "Peteris Krumins" <newsgroups@lf.lv>
To: "Walter D. Wyndroski" <wdwrn@friendlycity.net>
Cc: <lartc@mailman.ds9a.nl>
Sent: Friday, September 26, 2003 1:32 PM
Subject: Re[2]: [LARTC] Connection Tracking - How Many???


> Thursday, September 25, 2003, 10:35:39 PM, you wrote:
>
> WDW> Sorry, I must have missed it when reading the netfilter howto. I
> WDW> found it later when reading through it again: approx 32,000
connections
> WDW> per 512 megs of ram.
>
> Wrong.
> 1 conntrack entry = 292 Bytes.
> 512*1024 = 524800 KiloBytes
> 524800*1024 = 537395200 Bytes
>
> 537395200 / 292  = 1840394 connections.
>
> Of course this would simply kill the cpu.
> I am doing 35000 connection trackings at the moment at
> aprox. less than 80mb of ram on 266Mhz PII..
>
>
> P.Krumins
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>
****************************************************************************
******************
> * This message has been scanned by CityNET's email scanner for viruses and
dangerous content *
> * and is believed to be clean.  CityNET is proud to use MailScanner.  For
more information   *
> * concerning MailScanner, visit http://www.mailscanner.info
*
>
****************************************************************************
******************
>



**********************************************************************************************
* This message has been scanned by CityNET's email scanner for viruses and dangerous content *
* and is believed to be clean.  CityNET is proud to use MailScanner.  For more information   *
* concerning MailScanner, visit http://www.mailscanner.info                                  *
**********************************************************************************************

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: Re[2]: [LARTC] Connection Tracking - How Many???

[Damjan]

> >From the documentation links on www.netfilter.org -->
> http://iptables-tutorial.frozentux.net/iptables-tutorial.html
> 
> How many connections that the connection tracking table can hold depends
> upon a variable that can be set through the ip-sysctl functions in recent
> kernels. The default value held by this entry varies heavily depending on
> how much memory you have. On 128 MB of RAM you will get 8192 possible
> entries, and at 256 MB of RAM, you will get 16376 entries. You can read and
> set your settings through the /proc/sys/net/ipv4/ip_conntrack_max setting.

That's the default, you can increase that through the
/proc/sys/net/ipv4/ip_conntrack_max setting. 
Also you may need to increase the "hashsize=" parameter when loading the
ip_conntrack module.

-- 
Damjan Georgievski
jabberID: damjan@bagra.net.mk
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/