pycod
很多人在说我们讲故事吹NB 但是我们吹过的NB ,正在一一变为现实 !!!!!

nf_conntrack: table full, dropping packet

ip_conntrack or nf_conntrack : table full, dropping packet

 

 

 SOLUTION VERIFIED - Updated August 4 2020 at 1:57 AM - 

Issue

  • What do the following messages in the system log mean?
ip_conntrack: table full, dropping packet.
nf_conntrack: table full, dropping packet.
  • Packet drops on this system for connections using ip_conntrack or nf_conntrack iptables modules.
  • Messages seen in /var/log/messages on the compute nodes when one of the instances drops packets

Environment

Asked 7 years, 1 month ago
Viewed 91k times
22

I see a lot of these messages in /var/log/messages of my Linux server

kernel: nf_conntrack: table full, dropping packet.
kernel: __ratelimit: 15812 callbacks suppresse

while my server is under DoS attack but the memory is not still saturated. I am wondering what is the significance of the message and how to counter possible security implications.

share  improve this question   

3 Answers

21
 

The message means your connection tracking table is full. There are no security implications other than DoS. You can partially mitigate this by increasing the maximum number of connections being tracked, reducing the tracking timeouts or by disabling connection tracking altogether, which is doable on server, but not on a NAT router, because the latter will cease to function.

sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=54000
sysctl -w net.netfilter.nf_conntrack_generic_timeout=120
sysctl -w net.ipv4.netfilter.ip_conntrack_max=<more than currently set>
share  improve this answer   
  • 3
    These names may be different depending on your distro and kernel. You can discover their names by running sysctl --names --all | grep -i conntrack. Remember to edit /etc/sysctl.conf 
posted on 2020-11-17 07:11  pycod  阅读(113)  评论(0编辑  收藏  举报