Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I know that iptables can operate in stateful connection tracking mode and in a stateless mode.

My firewall rules are all in place I'm pretty sure that they are stateless but my question is how can I verify that the firewall is really operating in stateless mode?

share|improve this question
add comment

3 Answers 3

up vote 11 down vote accepted

You need to specify some iptables rules to prevent packets to be conntracked :

iptables -t raw -I PREROUTING -j NOTRACK
iptables -t raw -I OUTPUT -j NOTRACK
share|improve this answer
    
actually it is "-t raw" and not "-t RAW" but that was the missing pice. Thank you! –  tex Feb 11 '11 at 23:11
2  
Sorry, but this doesn't answer your question since it was "how can I verify that the firewall is really operating in stateless mode" actually. –  poige Feb 12 '11 at 4:07
    
Please excuse my wording. My english is not perfect, but that was exactly the solution for my problem. –  tex Aug 17 '12 at 17:21
add comment

cat /proc/net/ip_conntrack shows all connection tracking.

So, if it's stateless, the output of the above command should be empty.

(Alternatively, use cat /proc/net/nf_conntrack)

share|improve this answer
add comment

Install conntrack, and look at the output. I am pretty sure if you are stateless no connections will be displayed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.