Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've see the following in my logs every so often:

kernel: ip_conntrack: table full, dropping packet.

Currently, I have ip_conntrack_max set to 65536 (default, RHEL5).

Keeping memory usage in mind, how much can I safely increase this value? I've got 4GB ram on this box. One of the functions this machine serves is as a static content server, which probably explains the high connections counts, and also means I'd like to keep as much of the OS memory used for caching as possible.

Also, what's the difference between the following two? /proc/sys/net/ipv4/netfilter/ip_conntrack_max /proc/sys/net/ipv4/ip_conntrack_max

Which should I be editing?


share|improve this question

First, ask yourself a question: does your setup require connection tracking? If it is just a server and firewalling/NAT is done somewhere else, then you can probably disable conntrack all together.

Second, check if your conntrack entries make sense. Sometimes conntrack tables are filled with rubbish because of some network or firewall mis-configuration. Usually those are entries for connections which were never fully established. That may happen e.g. when the server gets incoming connection SYN packets, but the server replies are always lost somewhere on the network.

The only machines I had a 'ip_conntrack: table full' messages and which needed ip_conntrack_max increase (instead of fixing configuration), where routers doing NAT for quite big networks (thousands of endpoints).

If you know you need conntrack and it really needs to be bigger than it is, the increase the number until you get no more 'table full' messages. And watch the memory usage.

Some statistics about memory allocation for conntrack objects can be found in the /proc/slabinfo file.

share|improve this answer

The path with "netfilter" is the old way of referring to the same setting. You can edit either file.

# cat /proc/sys/net/ipv4/ip_conntrack_max  
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
# echo 655361  > /proc/sys/net/ipv4/ip_conntrack_max
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
share|improve this answer
In ubuntu 10.04/2.6.32-45-server, only ipv4/netfilter/ip_conntrack_max exists – okwap Feb 3 at 2:19
Your answer is dfferent from the… – okwap Feb 3 at 2:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.