Every so often you see messages in your logs regarding ip_conntrack like the following:
ip_conntrack: table full, dropping packet
So my first thought it that it might relate to memory usage. Fortunately enough the kernel provides all the information we need to work it out. The kernel will allocate a “slab” when ever conntrack requires more memory, equally it will retain these slabs for a period of time and reuse if required. Each “slab” represents a number of pages of kernel memory, we can retrieve the current page size by using the following command:
# getconf PAGESIZE
4096
So each page is 4096 bytes. Next lets see how many slabs conntrack is using:
# grep conntrack /proc/slabinfo
ip_conntrack 6537 16620 384 984 1662 1 : 496 124
So that represents the following:
- ip_conntrack; a human readable name
- 6537; total number of objects in use.
- 16620; total available objects (including unused)
- 384; size of each object.
- 984; the number of slabs that are active
- 1662; the total number of slabs
- 1; the number of pages required to make a slab (normally 1)
The two other columns after the colon relate to SMP CPU information; we don’t need to discuss them.
So 6537 objects each of size 384 bytes, which means that we can fix around 10 per slab (4096/384=10.66). That means that the objects represent 2510208 bytes (~2.4Mb), but because of the overhead we are actually using 654 (6537/10=653.7) slabs or 2.6Mb (654*4096=2678784). So we are wasting around 256 bytes per slab (4096-384*10).
In other words an extremely small amount of memory. So it is very unlikely that is the cause. Further investigation reveal that it is normally due to the conntrack hitting the maximum count which can be viewed by looking at:
# cat /proc/sys/net/ipv4/ip_conntrack_max
65536
Comparing this to the current count:
# wc -l ./proc/sys/net/ip_conntrack
5602 /proc/net/ip_conntrack
We now know that it doesn’t use any great deal of memory at all, so we can easily double the count by doing the following:
# echo 131072 >/proc/sys/net/ipv4/ip_conntrack_max
Obviously in this example the memory usage was minor and there was little need to double the count but you can review your own system and increase as you wish now we know that it has a very small memory footprint.