Re: nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count

[Afi Gjermund <afigjermund@gmail.com>]

On Mon, Feb 15, 2010 at 11:30 AM, Afi Gjermund <afigjermund@gmail.com> wrote:
> On Mon, Feb 15, 2010 at 11:00 AM, Jan Engelhardt <jengelh@medozas.de> wrote:
>>
>> On Monday 2010-02-15 19:04, Afi Gjermund wrote:
>>>>>>
>>>>>> I am running into an odd issue where the kernel begins to drop packets
>>>>>> because the connection tracking table is full. (I am running
>>>>>> 2.6.26.5).
>>>>>>
>>>>>> A 'cat /proc/sys/net/netfilter/nf_conntrack_count' says 4096.  But if
>>>>>> I do a 'cat /proc/net/nf_conntrack | wc -l' then it says 4.
>>>>>
>>>>>Conntracks might exist and not be in the global table anymore,
>>>>>f.i. when referenced by a packet. The difference in your case
>>>>>seems pretty extreme, so I'd guess that packets are leaked
>>>>>somewhere.
>>>>
>>>> So, that would make for 4092 expected connections then?
>>>>
>>>> Afi, what would `conntrack -L expect` give?
>>   (meant: conntrack -L expect | wc -l)
>>
>>>One thing to
>>>note is, I have stopped any traffic flowing through the device, and
>>>yet I am still receiving the kernel drop messages.  Any change its
>>>connection tracking on the loopback? ( I use the loopback for IPC ).
>>
>> Yes. conntrack does not care about what interface packets
>> come in or go out on. Unless it's NOTRACKed, it's counted.
>>
> Okay, after some tinkering I was able to get the userspace application
> going.  The results, however, do not seem that helpful.
>
> root@00:00:10:73:77:64 ~# ./conntrack -L expect | wc -l
> conntrack v0.9.14 (conntrack-tools): 0 expectations have been shown.
> 0
>
> root@titan ~# ./conntrack -L conntrack
> udp      17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=89099
> bytes=12968758 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=110358
> bytes=17041625 [ASSURED] mark=0 use=1
> udp      17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=87867
> bytes=12816098 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=107497
> bytes=16573614 [ASSURED] mark=0 use=1
> conntrack v0.9.14 (conntrack-tools): 2 flow entries have been shown.
>
> root@titan ~# cat /proc/sys/net/netfilter/nf_conntrack_count
> 4096
>
> root@titan ~# ./conntrack -S
> entries                 4096
> searched                2525930
> found                   418064263
> new                     295548
> invalid                 1509
> ignore                  233351
> delete                  291452
> delete_list             280256
> insert                  280258
> insert_failed           0
> drop                    69960
> early_drop              173185
> icmp_error              45
> expect_new              0
> expect_create           0
> expect_delete           0
>
Oops..wrong machine...

root@titan ~# ./conntrack -L expect | wc -l
conntrack v0.9.14 (conntrack-tools): 0 expectations have been shown.
0