conntrack table limits

conntrack table limits

[Dennis Jacobfeuerborn]

Hi,
I'm trying to find out how high I can set conntrack_max on a 2GB 64 bit 
system. On the net I found different ways of calculating this but they seem 
to end up with different results. One forumla tells me that I can fit a 
maximum of 65535 connections into 2GB of RAM but the other says that with 
304 bytes per connection (plus a bit of slab allocation overhead) I can 
easily fit more than a million connections into the table.
Also even with the current limit 65535 and the table having ca. 30.000 
entries I've almost 1.8GB ram free/cached which leads me to believe the 
second way of calculating this is more accurate.
What is the proper way to calculate this?

Regards,
   Dennis

Re: conntrack table limits

[Remzi AKYÜZ]

/etc/modules
nf_conntrack acct=1 hashsize=1048576

Hashsize calc;

HASHSIZE = CONNTRACK_MAX / 8 = RAMSIZE (in bytes) / 131072 = RAMSIZE (in MegaBytes) * 8
HASHSIZE = CONNTRACK_MAX / 8 = RAMSIZE (in bytes) / 131072 / (x / 32)
x= 32 or 64

CONNTRACK_MAX = HASHSIZE * 8


you can see this
http://antmeetspenguin.blogspot.com/2011/01/high-performance-linux-router.html
page.

On 01/25/2011 01:45 PM, Dennis Jacobfeuerborn wrote:
> Hi,
> I'm trying to find out how high I can set conntrack_max on a 2GB 64 
> bit system. On the net I found different ways of calculating this but 
> they seem to end up with different results. One forumla tells me that 
> I can fit a maximum of 65535 connections into 2GB of RAM but the other 
> says that with 304 bytes per connection (plus a bit of slab allocation 
> overhead) I can easily fit more than a million connections into the 
> table.
> Also even with the current limit 65535 and the table having ca. 30.000 
> entries I've almost 1.8GB ram free/cached which leads me to believe 
> the second way of calculating this is more accurate.
> What is the proper way to calculate this?
>
> Regards,
>   Dennis
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: conntrack table limits

[Dennis Jacobfeuerborn]

On 01/25/2011 02:49 PM, Remzi AKYÃœZ wrote:
> /etc/modules
> nf_conntrack acct=1 hashsize=1048576
>
> Hashsize calc;
>
> HASHSIZE = CONNTRACK_MAX / 8 = RAMSIZE (in bytes) / 131072 = RAMSIZE (in
> MegaBytes) * 8
> HASHSIZE = CONNTRACK_MAX / 8 = RAMSIZE (in bytes) / 131072 / (x / 32)
> x= 32 or 64
>
> CONNTRACK_MAX = HASHSIZE * 8

That makes sense, thanks.

> you can see this
> http://antmeetspenguin.blogspot.com/2011/01/high-performance-linux-router.html
> page.
>
> On 01/25/2011 01:45 PM, Dennis Jacobfeuerborn wrote:
>> Hi,
>> I'm trying to find out how high I can set conntrack_max on a 2GB 64 bit
>> system. On the net I found different ways of calculating this but they
>> seem to end up with different results. One forumla tells me that I can
>> fit a maximum of 65535 connections into 2GB of RAM but the other says
>> that with 304 bytes per connection (plus a bit of slab allocation
>> overhead) I can easily fit more than a million connections into the table.
>> Also even with the current limit 65535 and the table having ca. 30.000
>> entries I've almost 1.8GB ram free/cached which leads me to believe the
>> second way of calculating this is more accurate.
>> What is the proper way to calculate this?
>>
>> Regards,
>> Dennis
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>