ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Shazad Malik]

Hello everyone -

I have thoroughly searched the internet for this error message which keeps
getting prompted in my logs and drops packets.  I just cant figure out why
this problem is occuring.  Initially, I thought it was my IPSEC connections
which were the culprit but that is not true.

I have seen other explanations such as incresing your tcp max number as
your physical mem. increase.  Check you /proc/net/ip_conntrack file for the
current connections.  But none of these factors have anything to do with
this error.  I have only 2 connections, doing regular HTTP gets and its
filling my log file:


Jun  2 09:50:39 new kernel: ip_conntrack: table full, dropping packet.
Jun  2 09:53:29 new kernel: ip_conntrack: table full, dropping packet.
Jun  2 09:57:14 new kernel: ip_conntrack: table full, dropping packet.

ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Shazad Malik]

Hello everyone -

I have thoroughly searched the internet for this error message which keeps
getting prompted in my logs and drops packets.  I just cant figure out why
this problem is occuring.  Initially, I thought it was my IPSEC connections
which were the culprit but that is not true.

I have seen other explanations such as incresing your tcp max number as
your physical mem. increase.  Check you /proc/net/ip_conntrack file for the
current connections.  But none of these factors have anything to do with
this error.  I have only 2 connections, doing regular HTTP gets and its
filling my log file:


Jun  2 09:50:39 new kernel: ip_conntrack: table full, dropping packet.
Jun  2 09:53:29 new kernel: ip_conntrack: table full, dropping packet.
Jun  2 09:57:14 new kernel: ip_conntrack: table full, dropping packet.

-- 
Shazad Malik
work: (845)623-2161
fax: (845) 623-1154

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Nick Drage]

On Sun, Jun 02, 2002 at 11:25:31PM -0400, Shazad Malik wrote:

> I have seen other explanations such as incresing your tcp max number as
> your physical mem. increase.  Check you /proc/net/ip_conntrack file for the
> current connections.  But none of these factors have anything to do with
> this error.  I have only 2 connections, doing regular HTTP gets and its
> filling my log file:
> 
> Jun  2 09:50:39 new kernel: ip_conntrack: table full, dropping packet.
> Jun  2 09:53:29 new kernel: ip_conntrack: table full, dropping packet.
> Jun  2 09:57:14 new kernel: ip_conntrack: table full, dropping packet.

What's the output of

cat /proc/net/ip_conntrack 

look like?

-- 
FunkyJesus System Administration Team

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Jozsef Kadlecsik]

Hello,

On Sun, 2 Jun 2002, Shazad Malik wrote:

> I have seen other explanations such as incresing your tcp max number as
> your physical mem. increase.  Check you /proc/net/ip_conntrack file for the
> current connections.  But none of these factors have anything to do with
> this error.  I have only 2 connections, doing regular HTTP gets and its
> filling my log file:

You mean, that the command

# wc -l /proc/net/ip_conntrack

results something like "2 /proc/net/ip_conntrack" and you still got
the messages:

> Jun  2 09:50:39 new kernel: ip_conntrack: table full, dropping packet.

Simply unbelievable...

Regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
WWW-Home: http://www.kfki.hu/~kadlec
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Shazad Malik]

Hi Nick,

This is the output from my /proc/net/ip_conntrack:
========================
tcp      6 432000 ESTABLISHED src=192.168.100.100 dst=192.168.100.1
sport=4885 dport=22 src=192.
168.100.1 dst=192.168.100.100 sport=22 dport=4885 [ASSURED] use=1
tcp      6 431991 ESTABLISHED src=192.168.100.100 dst=24.228.35.215
sport=4884 dport=8080 src=24
.228.35.215 dst=24.168.132.35 sport=8080 dport=4884 [ASSURED] use=1
udp      17 137 src=24.168.132.35 dst=24.29.99.36 sport=45028 dport=53
src=24.29.99.36 dst=24.16
8.132.35 sport=53 dport=45028 [ASSURED] use=1
=========================

This is the output from /var/log/messages

Jun  3 08:03:28 new kernel: ip_conntrack: table full, dropping packet.
Jun  3 08:04:52 new last message repeated 7 times
Jun  3 08:04:53 new last message repeated 2 times


Seriously, I going beserk now!  I just have two machine sitting behind my
test box and just one user(thats me!). All I'm doing is surfing the web.
Dont have a clue why its happening!

shazad

> On Sun, Jun 02, 2002 at 11:25:31PM -0400, Shazad Malik wrote:
>
>> I have seen other explanations such as incresing your tcp max number
>> as your physical mem. increase.  Check you /proc/net/ip_conntrack file
>> for the current connections.  But none of these factors have anything
>> to do with this error.  I have only 2 connections, doing regular HTTP
>> gets and its filling my log file:
>>
>> Jun  2 09:50:39 new kernel: ip_conntrack: table full, dropping packet.
>> Jun  2 09:53:29 new kernel: ip_conntrack: table full, dropping packet.
>> Jun  2 09:57:14 new kernel: ip_conntrack: table full, dropping packet.
>
> What's the output of
>
> cat /proc/net/ip_conntrack
>
> look like?
>
> --
> FunkyJesus System Administration Team


-- 
Shazad Malik
work: (845)623-2161
fax: (845) 623-1154

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Rasmus Bøg Hansen]

On Mon, 3 Jun 2002, Shazad Malik wrote:

> Jun  3 08:03:28 new kernel: ip_conntrack: table full, dropping packet.

> Seriously, I going beserk now!  I just have two machine sitting behind my
> test box and just one user(thats me!). All I'm doing is surfing the web.
> Dont have a clue why its happening!

Perhaps you need a larger conntrack table?

echo 32768 > /proc/sys/net/ipv4/ip_conntrack_max

Be aware, that this could use a lot of memory (I don't remember how
much).

/Rasmus

-- 
-- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
He who asks a question is a fool for five minutes; he who does not ask a
question remains a fool forever.
----------------------------------[ moffe at amagerkollegiet dot dk ] --

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[Nick Drage]

On Mon, Jun 03, 2002 at 11:34:32PM +0200, Rasmus Bøg Hansen wrote:
> On Mon, 3 Jun 2002, Shazad Malik wrote:

> > Jun  3 08:03:28 new kernel: ip_conntrack: table full, dropping packet.
> 
> > Seriously, I going beserk now!  I just have two machine sitting behind
> > my test box and just one user(thats me!). All I'm doing is surfing the
> > web. Dont have a clue why its happening!
> 
> Perhaps you need a larger conntrack table?
> 
> echo 32768 > /proc/sys/net/ipv4/ip_conntrack_max
> 
> Be aware, that this could use a lot of memory (I don't remember how
> much).

I think Shazad said he'd tried increasing the size of the table already. 
Actually, what does

cat /proc/sys/net/ipv4/ip_conntrack_max

give you?

-- 
FunkyJesus System Administration Team

Re: ip_conntrack: table full, dropping packet. - Anyone????? Frustrating!

[George Georgalis]

Shazad, could it be a loop in your firewall rules?

// George

On Mon, Jun 03, 2002 at 11:16:36PM +0100, Nick Drage wrote:
>On Mon, Jun 03, 2002 at 11:34:32PM +0200, Rasmus Bøg Hansen wrote:
>> On Mon, 3 Jun 2002, Shazad Malik wrote:
>
>> > Jun  3 08:03:28 new kernel: ip_conntrack: table full, dropping packet.
>> 
>> > Seriously, I going beserk now!  I just have two machine sitting behind
>> > my test box and just one user(thats me!). All I'm doing is surfing the
>> > web. Dont have a clue why its happening!
>> 
>> Perhaps you need a larger conntrack table?
>> 
>> echo 32768 > /proc/sys/net/ipv4/ip_conntrack_max
>> 
>> Be aware, that this could use a lot of memory (I don't remember how
>> much).
>
>I think Shazad said he'd tried increasing the size of the table already. 
>Actually, what does
>
>cat /proc/sys/net/ipv4/ip_conntrack_max
>
>give you?
>
>-- 
>FunkyJesus System Administration Team
>
>

-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george