Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Billion BiPac 7700N Modem/Router/Access Point and I connect another router (TP-Link TL-WR1043ND) in wan-bypass mode to extend the wireless coverage. Lately, I noticed that the connection through TP-Link has been dropping out quite regularly.

Having read some posts on the Internet, I checked system log on 7700N and found that there are many "nf_conntract: expectation table full" errors, which I suppose the iptables are full.

My questions:

  1. What does constitute an entry on the iptable? Is it a client or a connection (which means one client can have multiple connections)
  2. How could I find out where are those connections originated from?

Note: Many reported that the issue is usually related to having torrents running but I don't have any torrents running.

Thank you.

share|improve this question
up vote 2 down vote accepted

An entry in the (expectation/regular) tracking table is a connection. You may have several from the same client.

On Linux you can check the expectation table content (and see where they come from) with:

sudo conntrack -L expect

But this conntrack tool is usually not installed by default (on Ubuntu you need to install the conntrack package). I don't know if you can install it on these modem/routers you have.

From the man page of conntrack:

Connection tracking expectations are the mechanism used to "expect" RELATED connections to existing ones. Expectations are generally used by "connection tracking helpers" (sometimes called application level gateways [ALGs]) for more complex protocols such as FTP, SIP, H.323.

So it's not any connection which is causing you trouble, it is a connection from a more complex protocol which needs a connection tracking helper (which I think is the case of torrents and several others P2P protocols).

share|improve this answer
Also, you could check the status of nf_conntrack_expect_max with sysctl net/netfilter/nf_conntrack_expect_max. If it's low and you still have RAM left, you can tune it to a higher value, e.g. by sysctl -w net/netfilter/nf_conntrack_expect_max=128. However, watch out, it eats memory. Funny, I've never seen this table running full, usually ip_conntrack_max comes first. – Alexander Janssen Oct 5 '12 at 16:17
Thank you for your response dgmorales and Alexander Janssen. Is there anyway to tell which client makes how many connection? – cbd Oct 7 '12 at 22:51
@cbd you could grep the output of sudo conntrack -L expect for the client IP. Also, if it's feasible to check each client machine you can use netstat on them. – dgmorales Oct 8 '12 at 13:17
I've just discovered the files /proc/net/ip_conntrack and /proc/net/ip_conntrack_expect, which seem to have the same information that conntrack -L outputs. Look for these files on your router, @cbd. You could grep them instead. – dgmorales Oct 8 '12 at 13:24
thanks @dgmorales I will try that – cbd Oct 12 '12 at 0:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.