During load testing my server is dropping packets due to "connection tracking" way before it's running out of resources. I'm using Ubuntu Jaunty with ufw. In my syslog I get:

ip_conntrack: table full, dropping packet.

I looked at upping the max connection table size, but I don't know of an advantage for tracking these connections on these ports. I would like to know how to use ufw to tell it not to track requests to port 80 and 443.


  • No natting needed, it's just a web server.

Thank you.


Connection tracking is an on/off switch, you cannot selectively disable it for some kind of traffic. You should increase the number of connections tracked via varius nf_conntrack_max options under /proc/sys/net. You can also consider enabling syncookies to reduce congestion effects.

Edit: It seems that iptables with -j NOTRACK allows you to disable connection tracking selectively.

  • How would I disable it completely? – reconbot Aug 26 '09 at 15:25
  • You can rmmod the nf_conntrack module after flushing firewall rules. – hayalci Aug 26 '09 at 19:35
  • 2
    That is partially incorrect. You can disable it for certain interfaces or ports using iptables, see below. – Jonathon Hill May 4 '12 at 22:57
iptables -A PREROUTING -p tcp --dport 80 -j NOTRACK 
iptables -A PREROUTING -p tcp --dport 443 -j NOTRACK 

will disable connection tracking just for these ports.

  • 1
    On an Ubuntu 10.04 server, that errored out, but this did work: iptables -t raw -A PREROUTING -i lo -j NOTRACK – Jonathon Hill May 4 '12 at 22:55

Do you NAT? I believe without ip_conntrack you can't NAT.

  • I don't use nat - just a web server – reconbot Jul 21 '09 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.