Re: nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count

[Douglas Diniz <dgdiniz@gmail.com>]

I did some tests removing all nat modules, leaving only the conntrack
core module and the problem still occurs.

I'm working in this problem for more than a week I stiil didnt found the cause.

On Thu, Feb 18, 2010 at 4:22 PM, Patrick McHardy <kaber@trash.net> wrote:
> Douglas Diniz wrote:
>> I'm facing the same problem. I'm working in a embedded system with
>> kernel 2.6.20-6. When I send a ping (or any other protocol) through
>> eth0 to eth1 (or vice versa) the conntrack count isn't decremented. If
>> I send the ping through any other interface (eth0 to wifi, eth1 to
>> wifi, wifi to eth0 and wifi to eth1) I have no problem.
>> The problem seems to be only between the ethernet interfaces.
>> I debug the netfilter and I saw that when the problem occurs the "use"
>> variable inside conntract structure in > 1, so this variable is only
>> decremented by 1, not reaching in 0, and then the destroy_conntrack
>> function is not called.
>>
>> So I think that the problem is more low level, and some events aren't
>> reaching netfilter, and the "use"variable isn't decremented properly.
>>
>> This could be a problem with the ethernet driver?
>
> Yes, although you'd likely notice other effects like running
> out of memory if it was leaking the packets.
>