09/02/2007 - Environ 1 minute de lecture

Stuff that happens to cluster sysadmins

Suddenly getting 60% packet loss between the LAN and the cluster, just because

kernel: ip_conntrack: table full, dropping packet.

Fix the problem by raising the limit from 65536 to 2097152 slots. If this limit is reached, that’ll eat 700MB of memory, ouch.

Pierre Phaneuf dit :

09/02/2007 à 19:03

Hey! That’s work stuff!
Hastur dit :

12/02/2007 à 08:25

You might want to consider setting ip_conntrack_tcp_timeouts to more reasonable values than the defaults
Calim (Martin H.) dit :

13/02/2007 à 12:44

Hi Colin,

It happened to me too :) Remember that /proc/sys/net/ipv4/netfilter/ip_conntrack_max is reseted do it’s default value each time ip_conntrack kernel modules in reloaded. It happens on RedHat when issuing a « service iptables restart » for examples.

Solution:
adding args to the module loading statement in modprobe.conf (redhat) , like this:
options ip_conntrack hashsize=32768

With ip_conntrack_max = hashsize * 8

Greets !!!