ip_conntrack or nf_conntrack : table full, dropping packet

nf_conntrack: table full, dropping packet

ip_conntrack or nf_conntrack : table full, dropping packet

 SOLUTION VERIFIED - Updated August 4 2020 at 1:57 AM -

English

Issue

• What do the following messages in the system log mean?

Raw

ip_conntrack: table full, dropping packet.
nf_conntrack: table full, dropping packet.

• Packet drops on this system for connections using ip_conntrack or nf_conntrack iptables modules.
• Messages seen in /var/log/messages on the compute nodes when one of the instances drops packets

Environment

Ask Question

Asked 7 years, 1 month ago

Active 2 years, 2 months ago

Viewed 91k times

22

11

I see a lot of these messages in /var/log/messages of my Linux server

kernel: nf_conntrack: table full, dropping packet.
kernel: __ratelimit: 15812 callbacks suppresse

while my server is under DoS attack but the memory is not still saturated. I am wondering what is the significance of the message and how to counter possible security implications.

denial-of-service

share  improve this question  follow 

edited Oct 2 '13 at 8:55

Rory Alsop

60.9k1111 gold badges111111 silver badges310310 bronze badges

asked Oct 2 '13 at 5:44

hnn

93722 gold badges88 silver badges1212 bronze badges

add a comment

3 Answers

ActiveOldestVotes

21

 

The message means your connection tracking table is full. There are no security implications other than DoS. You can partially mitigate this by increasing the maximum number of connections being tracked, reducing the tracking timeouts or by disabling connection tracking altogether, which is doable on server, but not on a NAT router, because the latter will cease to function.

sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=54000
sysctl -w net.netfilter.nf_conntrack_generic_timeout=120
sysctl -w net.ipv4.netfilter.ip_conntrack_max=<more than currently set>

share  improve this answer  follow 

answered Oct 2 '13 at 8:13

Matrix

3,7881212 silver badges2525 bronze badges

• 3
  These names may be different depending on your distro and kernel. You can discover their names by running sysctl --names --all | grep -i conntrack. Remember to edit /etc/sysctl.conf