FREE TRIAL

Deploy a Free VPS Server Worldwide. No Credit Card Required.

Start Free Trial
  • +357 2425 0808
  • Login
  • English

Home

Blog

How To Fix Error nf_conntrack table full...

How To Fix Error nf_conntrack table full dropping packet in Linux Servers

How To Fix Error nf_conntrack table full dropping packet in Linux Servers

NetShop ISP

NetShop ISP · Blog Author

Jan 20, 2022 · Tutorials

In this article we will help you resolve an issue which can come up on Linux CentOS servers that creates network flapping and packet loss.

Issue

During network monitoring of one of our customers’ servers we detected a network flapping. Accessing the server via ssh was not possible (due to the heavy network usage) so we connected to it via iDRAC.

The following messages were seen in /var/log/messages (they may also appear in /var/log/kern):

$ tail -f /var/log/messages
Jan  14 02:11:05 centos kernel: : nf_conntrack: table full, dropping packet
Jan  14 02:11:09 centos kernel: : nf_conntrack: table full, dropping packet

A server can enter this panic state in cases that it’s under a DDoS attack or very likely to happen when there are a lot of network connections. Our client’s server was used for virtualization so one or more Virtual machines happened to generate a lot of network packets.

CentOS servers, by default, allow 65,536 connections. This limit is enough for lightly loaded servers, but it can be exhausted on high traffic servers.

How To Fix

During a disaster it is important to remain calm. Below you can read how to mitigate this issue and resolve the network flapping. We provide the solution for both CentOS 6 and CentOS 7 environments.

Solution for CentOS 6

Step 1: Check value of nf_conntrack_max

Run the following command to check the value of nf_conntrack_max:

$ sysctl net.netfilter.nf_conntrack_max

Step 2: Check number of active connections

$ cat /proc/sys/net/netfilter/nf_conntrack/count

If the value of nf_conntrack_max is reached, then the server is dropping packets already.

Step 3: Increase value for nf_conntrack_max *

$ sysctl -w net.netfilter.nf_conntrack_max=2097152

To make the above change persistent after reboot, do this:

$ echo "net.netfilter.nf_conntrack_max=2097152" >> /etc/sysctl.conf

* To properly calculate the ideal nf_conntrack_max value, use the following formula:

CONNTRACK_MAX = RAM_MEMORY_SIZE (in bytes) / 16384 / 2

Step 4: Restart Iptables

$ service iptables restart && service iptables save

Solution for CentOS 7

Step 1: Increase size of has table for conntrack connections *

$ echo "options nf_conntrack expect_hashsize=131072 hashsize=131072" >> /etc/modprobe.d/firewalld-sysctls.conf

* To calculate the new hash value use this formula:

HASHSIZE = CONNTRACK_MAX / 4

Step 2: Restart Firewalld

$ systemctl restart firewalld

Step 3: Verify new nf_conntrack_max value

$ sysctl -a | grep nf_conntrack_max

Categories

Backup
6
Business Continuity
4
Cloud Hosting
10
Colocation
4
Company Updates
1
Cryptocurrencies
1
Data Centers
12
Dedicated Servers
4
Disaster Recovery
3
Forex
25
Gaming
1
iGaming
33
Industry News
32
Interviews
10
Joomla
9
Magento
5
Managed Services
1
Operating Systems
1
Press Releases
65
Product News
6
Resellers
1
Security
25
Software & Apps
1
Streaming
1
Tech Startups
12
Tutorials
60
Uncategorized
389
Vps Hosting
11
Web Design & Development
3
Web Hosting
44
Webinars
1
Wordpress
14

Free VPS Trial

No Credit Card Required.

Recent Posts

How To Fix Error Failed to download metadata for repo in CentOS 8

How To Fix Error Failed to download metadata for repo in CentOS 8

23 March, 2023

How can Forex Brokers be Protected from DDoS Attacks

How can Forex Brokers be Protected from DDoS Attacks

20 March, 2023

NetShop ISP Bronze Sponsors for the University of Cyprus at Harvard WorldMUN 2023

NetShop ISP Bronze Sponsors for the University of Cyprus at Harvard WorldMUN 2023

15 March, 2023

Top 5 Cloud Computing Trends in 2023

Top 5 Cloud Computing Trends in 2023

13 March, 2023

MetaTrader 4 and 5 Apps are back on Apple AppStore

MetaTrader 4 and 5 Apps are back on Apple AppStore

07 March, 2023

#letushostyou

Award Winning Hosting Provider established in 2004.

Best iGaming Service ProviderISO Certified

120 Faneromenis Avenue, Imperial Tower, 2nd Floor, Larnaca 6031, Cyprus

Products

Bare Metal Servers

Customized Servers

Virtual / Cloud Servers

Forex VPS

Storage VPS

cPanel Web Hosting

Reseller Web Hosting

Colocation

Addons

Premium DNS

Email Hosting

Cloud Backup

DDoS Protection

Licenses

SSL Certificates

Domain Names

Premium SLAs

About Us

Data Center Locations

Looking Glass

Our Company

Contact Us

Careers in Cyprus

Become a Partner

Awards

Certifications

© 2023 S.S. NetShop Internet Services Ltd. All rights reserved.  Terms & Conditions  |  Privacy Policy
CY Reg. Number: HE 217340 | EU VAT Number: CY10217340J

Visa
Mastercard
PayPal
Bitcoin
Tether
Ethereum
Litecoin
Wise
Revolut
Wire Transfer