From mboxrd@z Thu Jan 1 00:00:00 1970 From: Afi Gjermund Subject: Re: nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count Date: Mon, 15 Feb 2010 11:45:33 -0800 Message-ID: <48ceaa831002151145y5a22aa32qe08c0d3401c652c2@mail.gmail.com> References: <48ceaa831002150927q166b5955gfa0e1e465903d29d@mail.gmail.com> <4B798487.6040304@trash.net> <48ceaa831002151004w16b548f4tc627252e94a632b6@mail.gmail.com> <48ceaa831002151130j3c96c72an40653869aac63814@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Cc: Patrick McHardy , netfilter-devel@vger.kernel.org To: Jan Engelhardt Return-path: Received: from mail-pz0-f197.google.com ([209.85.222.197]:48379 "EHLO mail-pz0-f197.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753163Ab0BOTpd (ORCPT ); Mon, 15 Feb 2010 14:45:33 -0500 Received: by pzk35 with SMTP id 35so578949pzk.33 for ; Mon, 15 Feb 2010 11:45:33 -0800 (PST) In-Reply-To: <48ceaa831002151130j3c96c72an40653869aac63814@mail.gmail.com> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Mon, Feb 15, 2010 at 11:30 AM, Afi Gjermund wrote: > On Mon, Feb 15, 2010 at 11:00 AM, Jan Engelhardt wrote: >> >> On Monday 2010-02-15 19:04, Afi Gjermund wrote: >>>>>> >>>>>> I am running into an odd issue where the kernel begins to drop packets >>>>>> because the connection tracking table is full. (I am running >>>>>> 2.6.26.5). >>>>>> >>>>>> A 'cat /proc/sys/net/netfilter/nf_conntrack_count' says 4096. But if >>>>>> I do a 'cat /proc/net/nf_conntrack | wc -l' then it says 4. >>>>> >>>>>Conntracks might exist and not be in the global table anymore, >>>>>f.i. when referenced by a packet. The difference in your case >>>>>seems pretty extreme, so I'd guess that packets are leaked >>>>>somewhere. >>>> >>>> So, that would make for 4092 expected connections then? >>>> >>>> Afi, what would `conntrack -L expect` give? >> (meant: conntrack -L expect | wc -l) >> >>>One thing to >>>note is, I have stopped any traffic flowing through the device, and >>>yet I am still receiving the kernel drop messages. Any change its >>>connection tracking on the loopback? ( I use the loopback for IPC ). >> >> Yes. conntrack does not care about what interface packets >> come in or go out on. Unless it's NOTRACKed, it's counted. >> > Okay, after some tinkering I was able to get the userspace application > going. The results, however, do not seem that helpful. > > root@00:00:10:73:77:64 ~# ./conntrack -L expect | wc -l > conntrack v0.9.14 (conntrack-tools): 0 expectations have been shown. > 0 > > root@titan ~# ./conntrack -L conntrack > udp 17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=89099 > bytes=12968758 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=110358 > bytes=17041625 [ASSURED] mark=0 use=1 > udp 17 179 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=87867 > bytes=12816098 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=107497 > bytes=16573614 [ASSURED] mark=0 use=1 > conntrack v0.9.14 (conntrack-tools): 2 flow entries have been shown. > > root@titan ~# cat /proc/sys/net/netfilter/nf_conntrack_count > 4096 > > root@titan ~# ./conntrack -S > entries 4096 > searched 2525930 > found 418064263 > new 295548 > invalid 1509 > ignore 233351 > delete 291452 > delete_list 280256 > insert 280258 > insert_failed 0 > drop 69960 > early_drop 173185 > icmp_error 45 > expect_new 0 > expect_create 0 > expect_delete 0 > Oops..wrong machine... root@titan ~# ./conntrack -L expect | wc -l conntrack v0.9.14 (conntrack-tools): 0 expectations have been shown. 0