[PATCH] netfilter: conntrack: document sparse hash table eviction

[PATCH] netfilter: conntrack: document sparse hash table eviction

[Vikash SS]

When nf_conntrack_max is significantly smaller than
nf_conntrack_buckets, the hash table can become sparsely populated.

The early_drop() path examines at most 8 consecutive hash buckets
when searching for eviction candidates. Under table exhaustion,
this bounded search may fail to find an eligible entry even when
evictable connections exist elsewhere in the table.

Document this limitation to clarify the implications of configuring
nf_conntrack_max significantly below nf_conntrack_buckets.

Signed-off-by: Vikash SS <thisisforspotifyvikash@gmail.com>
---
 Documentation/networking/nf_conntrack-sysctl.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst
index 4426cce2a..fc07a950b 100644
--- a/Documentation/networking/nf_conntrack-sysctl.rst
+++ b/Documentation/networking/nf_conntrack-sysctl.rst
@@ -99,6 +99,10 @@ nf_conntrack_max - INTEGER
         the reversed address). This means that with default settings a maxed-out
         table will have a average hash chain length of 2, not 1.
 
+        Setting nf_conntrack_max much lower than nf_conntrack_buckets
+        may cause early eviction to fail under table exhaustion, as
+        the eviction search may not find entries in sparse hash tables.
+
 nf_conntrack_tcp_be_liberal - BOOLEAN
 	- 0 - disabled (default)
 	- not 0 - enabled
-- 
2.34.1

Re: [PATCH] netfilter: conntrack: document sparse hash table eviction

[Pablo Neira Ayuso]

On Fri, Nov 06, 2026 at 01:58:16PM +0000, Vikash SS wrote:
> When nf_conntrack_max is significantly smaller than
> nf_conntrack_buckets, the hash table can become sparsely populated.
> 
> The early_drop() path examines at most 8 consecutive hash buckets
> when searching for eviction candidates. Under table exhaustion,
> this bounded search may fail to find an eligible entry even when
> evictable connections exist elsewhere in the table.
> 
> Document this limitation to clarify the implications of configuring
> nf_conntrack_max significantly below nf_conntrack_buckets.
> 
> Signed-off-by: Vikash SS <thisisforspotifyvikash@gmail.com>
> ---
>  Documentation/networking/nf_conntrack-sysctl.rst | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst
> index 4426cce2a..fc07a950b 100644
> --- a/Documentation/networking/nf_conntrack-sysctl.rst
> +++ b/Documentation/networking/nf_conntrack-sysctl.rst
> @@ -99,6 +99,10 @@ nf_conntrack_max - INTEGER
>          the reversed address). This means that with default settings a maxed-out
>          table will have a average hash chain length of 2, not 1.
>  
> +        Setting nf_conntrack_max much lower than nf_conntrack_buckets
> +        may cause early eviction to fail under table exhaustion, as
> +        the eviction search may not find entries in sparse hash tables.

Maybe provide a positive hint:

+        Make sure nf_conntrack_max is equal to or larger than
+        nf_conntrack_buckets, otherwise early drop may fail to evict
+        entries when it gets full.

>  nf_conntrack_tcp_be_liberal - BOOLEAN
>  	- 0 - disabled (default)
>  	- not 0 - enabled
> -- 
> 2.34.1
> 

[PATCH v2] netfilter: conntrack: document sparse hash table eviction

[Vikash SS]

When nf_conntrack_max is significantly smaller than
nf_conntrack_buckets, the hash table can become sparsely populated.

The early_drop() path examines at most 8 consecutive hash buckets
when searching for eviction candidates. Under table exhaustion,
this bounded search may fail to find an eligible entry even when
evictable connections exist elsewhere in the table.

Document this limitation to clarify the implications of configuring
nf_conntrack_max significantly below nf_conntrack_buckets.

Signed-off-by: Vikash SS <thisisforspotifyvikash@gmail.com>
---
 Changes in v2:
 - Reword documentation to provide configuration guidance,
   as suggested by Pablo Neira Ayuso.

 Documentation/networking/nf_conntrack-sysctl.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst
index 4426cce2a..c7e9016ac 100644
--- a/Documentation/networking/nf_conntrack-sysctl.rst
+++ b/Documentation/networking/nf_conntrack-sysctl.rst
@@ -99,6 +99,10 @@ nf_conntrack_max - INTEGER
         the reversed address). This means that with default settings a maxed-out
         table will have a average hash chain length of 2, not 1.
 
+        Make sure nf_conntrack_max is equal to or larger than
+        nf_conntrack_buckets, otherwise early drop may fail to evict
+        entries when it gets full.
+
 nf_conntrack_tcp_be_liberal - BOOLEAN
 	- 0 - disabled (default)
 	- not 0 - enabled
-- 
2.34.1