hi,all,

I'm a newbie of netfilter.I have a problem on it. I think it maybe has some bugs.

A month ago my gateway using linux2.4-7-10 can not forward any packets because it's conntrack table is full, it displaies "ip_conntrack: table full, dropping packet.".the memory of the gateway is 256M.
After that i do a experiment on it.

I set the variable hash_size 20, then the variabel ip_conntrack_max should be 160.
I adjust the TCP timeout on established to 1 hours, and decrease the udp timeout to 1/3 of original value.
I deny the broadcast packet to leave track in conntrack table by open the condition '#if 0 ' to '#if 1' in header of function ip_conntrack_in .
I print the value of ip_conntrack_count in the header of function init_conntrack.

After 2 days, the conntrack table is full, /var/log/messages display the ip_conntrack_count is 167, and /proc/net/ip_conntrack is empty. 

Why?!, Why the ip_conntrack_count is bigger than ip_conntrack_max?
Why is /proc/net/ip_conntrack is empty?
how can this occurs?

who can help me?

thanks in advance!