Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.

share|improve this question
up vote 1 down vote accepted

Reference: conntrack man page

The connection tracking system maintains two different tables, one for tracking connections that are active the other for tracking connections that are /expected/ to be active. An example of an expected connection would be an FTP connection, which uses both a control connection and a data connection. When the control connection is opened, the data connection is expected to be opened.

In a single table solution, a denial-of-service could be triggered by filling the table with expectations, starving out legitimate, active connections. The separate table helps to prevent that.

In the two system setup, nf_conntrack_expect_max is the max number of entries for the expectations table, and its function is identical to that of nf_conntrack_max for the conntrack table.

share|improve this answer
How can I go about determining an ideal value for nf_conntrack_expect_max? – KelchM Feb 27 '13 at 18:33
Are you doing a lot of traffic that creates entries in the expectations table? If not, you don't even need to worry about it. If so, see how many entries typically get created, and then allow for a reasonable buffer above that. – hrunting Feb 28 '13 at 3:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.