How to turn iptables stateless?

Question

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I know that iptables can operate in stateful connection tracking mode and in a stateless mode.

My firewall rules are all in place I'm pretty sure that they are stateless but my question is how can I verify that the firewall is really operating in stateless mode?

Answer 1

You need to specify some iptables rules to prevent packets to be conntracked :

iptables -t raw -I PREROUTING -j NOTRACK
iptables -t raw -I OUTPUT -j NOTRACK

Answer 2

Install conntrack, and look at the output. I am pretty sure if you are stateless no connections will be displayed.

Answer 3

cat /proc/net/ip_conntrack shows all connection tracking.

So, if it's stateless, the output of the above command should be empty.

(Alternatively, use cat /proc/net/nf_conntrack)