now to increase ip_conntrack_max in 2.6.28?

now to increase ip_conntrack_max in 2.6.28?

[Alec Matusis]

I need to increase the number of connections that netfilter can track on a
production server, to avoid "ip_conntrack: table full, dropping packet"
messages.
On 2.6.24 (ubuntu 8.04) it was:
echo 524288 > /proc/sys/net/ipv4/netfilter/ip_conntrack_max

On 2.6.28 (ubuntu 9.04) the entire /proc/sys/net/ipv4/netfilter directory is
missing. Moreover, 

find / -name ip_conntrack_max 

returns NOTHING.

How do I increase this?

Re: now to increase ip_conntrack_max in 2.6.28?

[Marek Kierdelewicz]

Hi Alec,

>On 2.6.28 (ubuntu 9.04) the entire /proc/sys/net/ipv4/netfilter
>directory is missing. Moreover, 

Make sure you have nf_conntrack loaded. It you do, then file you're
looking for is here:
/proc/sys/net/nf_conntrack_max

Cheers,
Marek Kierdelewicz

RE: now to increase ip_conntrack_max in 2.6.28?

[Alec Matusis]

Thank you Marek, in Ubuntu 9.04 server edition nf_conntrack module
apparently is not loaded by default. I wonder why... What confused me was
that iptables rules actually worked, so I thought the module must have been
loaded.
I loaded it, and the file appeared.

> -----Original Message-----
> From: Marek Kierdelewicz [mailto:marek@piasta.pl]
> Sent: Monday, July 27, 2009 11:53 PM
> To: Alec Matusis
> Cc: netfilter@vger.kernel.org
> Subject: Re: now to increase ip_conntrack_max in 2.6.28?
> 
> Hi Alec,
> 
> >On 2.6.28 (ubuntu 9.04) the entire /proc/sys/net/ipv4/netfilter
> >directory is missing. Moreover,
> 
> Make sure you have nf_conntrack loaded. It you do, then file you're
> looking for is here:
> /proc/sys/net/nf_conntrack_max
> 
> Cheers,
> Marek Kierdelewicz