Re: [PATCH] netfilter: conntrack: document sparse hash table eviction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Nov 06, 2026 at 01:58:16PM +0000, Vikash SS wrote:
> When nf_conntrack_max is significantly smaller than
> nf_conntrack_buckets, the hash table can become sparsely populated.
> 
> The early_drop() path examines at most 8 consecutive hash buckets
> when searching for eviction candidates. Under table exhaustion,
> this bounded search may fail to find an eligible entry even when
> evictable connections exist elsewhere in the table.
> 
> Document this limitation to clarify the implications of configuring
> nf_conntrack_max significantly below nf_conntrack_buckets.
> 
> Signed-off-by: Vikash SS <thisisforspotifyvikash@gmail.com>
> ---
>  Documentation/networking/nf_conntrack-sysctl.rst | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst
> index 4426cce2a..fc07a950b 100644
> --- a/Documentation/networking/nf_conntrack-sysctl.rst
> +++ b/Documentation/networking/nf_conntrack-sysctl.rst
> @@ -99,6 +99,10 @@ nf_conntrack_max - INTEGER
>          the reversed address). This means that with default settings a maxed-out
>          table will have a average hash chain length of 2, not 1.
>  
> +        Setting nf_conntrack_max much lower than nf_conntrack_buckets
> +        may cause early eviction to fail under table exhaustion, as
> +        the eviction search may not find entries in sparse hash tables.

Maybe provide a positive hint:

+        Make sure nf_conntrack_max is equal to or larger than
+        nf_conntrack_buckets, otherwise early drop may fail to evict
+        entries when it gets full.

>  nf_conntrack_tcp_be_liberal - BOOLEAN
>  	- 0 - disabled (default)
>  	- not 0 - enabled
> -- 
> 2.34.1
>