ip_conntrack: maximum limit of 16368 entries exceeded

ip_conntrack: maximum limit of 16368 entries exceeded

[rtviado]

Hello,

I got this in my logs:

 ip_conntrack: maximum limit of 16368 entries exceeded

what does this mean, I know i can change the limits in
/proc/sys/net/ipv4/ip_conntrack_max, but I want to know what this is for.

P.S. I looked into linux/Documentation but did not find any mention of
this configrable parameter....


-- 
Rodel T. Viado
System Administrator
Iligan Global Access Network Inc.





-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: ip_conntrack: maximum limit of 16368 entries exceeded

[Sven Koch]

On Tue, 16 Jan 2001, rtviado wrote:

> I got this in my logs:
>
>  ip_conntrack: maximum limit of 16368 entries exceeded
>
> what does this mean, I know i can change the limits in
> /proc/sys/net/ipv4/ip_conntrack_max, but I want to know what this is for.

This means that iptable is tracking more than 16368 parallel connections.
Either a very busy box or some spoofed flooding.

> P.S. I looked into linux/Documentation but did not find any mention of
> this configrable parameter....

see http://netfilter.kernelnotes.org/ - seems that the in-kernel documents
are not uptodate

c'ya
sven

-- 

The Internet treats censorship as a routing problem, and routes around it.
(John Gilmore on http://www.cygnus.com/~gnu/)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: ip_conntrack: maximum limit of 16368 entries exceeded

[Rusty Russell]

In message <Pine.LNX.4.30.0101161444450.24215-100000@bigbird-ipgi.iligan.com> y
ou write:
> I got this in my logs:
> 
>  ip_conntrack: maximum limit of 16368 entries exceeded

It's  OK, it  just means  that you  have *alot*  of  connections going
through your box (or maybe you don't route both ways through your box,
which you need to do for  connection tracking to work).  We have to be
slow in  timing out connections, but  when the limit gets  hit, we get
more aggressive: the algo's pretty  good, so you probably won't notice
any problems.

Cheers,
Rusty.
--
http://linux.conf.au The Linux conference Australia needed.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/