Senior LevelLinux Commands & SysAdmin
How do you diagnose and tune the Netfilter Connection Tracking (conntrack) table under heavy load?
❓ Interview Prompt: Explain Netfilter conntrack (connection tracking), table exhaustion ('ip_conntrack: table full, dropping packet'), nf_conntrack_max, and hashsize tuning.
Stateful firewalls and NAT routers use Netfilter Connection Tracking (conntrack) to keep track of active network flows.
Table Exhaustion Issue:
Under heavy DDoS attacks or high-traffic workloads, the conntrack table fills up, causing the kernel to print 'nf_conntrack: table full, dropping packet' and drop incoming connections!
Tuning:
Increase 'net.netfilter.nf_conntrack_max' and adjust 'hashsize' (hashsize = nf_conntrack_max / 8).
Code Implementation Example
bash
# Check current conntrack table entries vs maximum limit
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max
# Increase max conntrack limit to 1,000,000 entries
sudo sysctl -w net.netfilter.nf_conntrack_max=1000000
# Update conntrack hashsize in kernel module
echo 125000 | sudo tee /sys/module/nf_conntrack/parameters/hashsize💡Monitoring and tuning Netfilter conntrack table limits.
🎯 Interview Key Takeaway
Tune nf_conntrack_max and hashsize on high-traffic servers to prevent firewall connection table exhaustion.
#conntrack#Netfilter#Firewall Tuning#DDoS#Senior
Back to all Linux Commands & SysAdmin Questions→