Determining number of active connections

Determining number of active connections

[jason.faulkner]

Hi all,

I'd like to be able to monitor (trend) the number of tracked connections in iptables; however, doing something like "cat /proc/net/ip_conntrack | wc -l" eats up too much CPU to run with regularity (we track somewhere in the realm of 200,000 connections).

Is there a way to just pull the total number? It'd be nice to know that we aren't even getting close to the number of connections set in the sysctl. 

Thanks!

--
Jason Faulkner 
Linux Systems Engineer
Mailtrust, a division of Rackspace

Re: Determining number of active connections

[Erik Wasser]

On Tuesday 10 March 2009, jason.faulkner@mailtrust.com wrote:
> Hi all,
>
> I'd like to be able to monitor (trend) the number of tracked
> connections in iptables; however, doing something like "cat
> /proc/net/ip_conntrack | wc -l" eats up too much CPU to run with
> regularity (we track somewhere in the realm of 200,000 connections).
>
> Is there a way to just pull the total number? It'd be nice to know
> that we aren't even getting close to the number of connections set in
> the sysctl.

Hi,

check out the following files:

/proc/sys/net/ipv4/netfilter/{ip_conntrack_count,ip_conntrack_max}

-- 
So long... Fuzz

Re: Determining number of active connections

[jason.faulkner]

-----Original Message-----
From: "Erik Wasser" <erik.wasser@iquer.net>
Sent: Tuesday, March 10, 2009 11:22am
To: netfilter@vger.kernel.org
Cc: jason.faulkner@mailtrust.com
Subject: Re: Determining number of active connections

>check out the following files:
>
>/proc/sys/net/ipv4/netfilter/{ip_conntrack_count,ip_conntrack_max}

Thanks for this information :) This is awesome for my new firewalls.

However, I have a few old 2.4 kernel firewalls (RHEL3), and they don't seem to have an ip_conntrack_count anywhere. Is there something for those? 




--
Jason Faulkner 
Linux Systems Engineer
Mailtrust, a division of Rackspace

Re: Determining number of active connections

[Pablo Neira Ayuso]

jason.faulkner@mailtrust.com wrote:
> Hi all,
> 
> I'd like to be able to monitor (trend) the number of tracked connections in iptables; however, doing something like "cat /proc/net/ip_conntrack | wc -l" eats up too much CPU to run with regularity (we track somewhere in the realm of 200,000 connections).
> 
> Is there a way to just pull the total number? It'd be nice to know that we aren't even getting close to the number of connections set in the sysctl. 

$ cat /proc/sys/net/netfilter/nf_conntrack_count

or with the conntrack-tools-0.9.11

# conntrack -C

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers