Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

During load testing my server is dropping packets due to "connection tracking" way before it's running out of resources. I'm using Ubuntu Jaunty with ufw. In my syslog I get:

ip_conntrack: table full, dropping packet.

I looked at upping the max connection table size, but I don't know of an advantage for tracking these connections on these ports. I would like to know how to use ufw to tell it not to track requests to port 80 and 443.

Clarifying

  • No natting needed, it's just a web server.

Thank you.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

Connection tracking is an on/off switch, you cannot selectively disable it for some kind of traffic. You should increase the number of connections tracked via varius nf_conntrack_max options under /proc/sys/net. You can also consider enabling syncookies to reduce congestion effects.

Edit: It seems that iptables with -j NOTRACK allows you to disable connection tracking selectively.

share|improve this answer
    
How would I disable it completely? –  reconbot Aug 26 '09 at 15:25
    
You can rmmod the nf_conntrack module after flushing firewall rules. –  hayalci Aug 26 '09 at 19:35
2  
That is partially incorrect. You can disable it for certain interfaces or ports using iptables, see below. –  Jonathon Hill May 4 '12 at 22:57
iptables -A PREROUTING -p tcp --dport 80 -j NOTRACK 
iptables -A PREROUTING -p tcp --dport 443 -j NOTRACK

will disable connection tracking just for these ports.

share|improve this answer
    
On an Ubuntu 10.04 server, that errored out, but this did work: iptables -t raw -A PREROUTING -i lo -j NOTRACK –  Jonathon Hill May 4 '12 at 22:55

Do you NAT? I believe without ip_conntrack you can't NAT.

share|improve this answer
    
I don't use nat - just a web server –  reconbot Jul 21 '09 at 19:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.