{"id":476,"date":"2015-06-14T16:02:31","date_gmt":"2015-06-14T08:02:31","guid":{"rendered":"http:\/\/www.ipcpu.com\/?p=476"},"modified":"2015-06-14T16:02:31","modified_gmt":"2015-06-14T08:02:31","slug":"nf_conntrack-table-full","status":"publish","type":"post","link":"https:\/\/c.ipcpu.com\/2015\/06\/nf_conntrack-table-full\/","title":{"rendered":"\u89e3\u51b3nf_conntrack: table full, dropping packet"},"content":{"rendered":"
<\/div>\n

\u4e00\u3001nf_conntrack\u6982\u8ff0<\/h2>\n

nf_conntrack \uff08\u8001\u7248\u672c\u540d\u79f0\u53ebip_conntrack\uff09\u662fNetfilter\u6846\u67b6\u91cc\u9762\u7528\u6765\u8bb0\u5f55\u4e00\u4e2a\u6570\u636e\u5305\u548c\u5176\u8fde\u63a5\u5173\u7cfb\u7684\u6a21\u5757\u3002<\/p>\n

Neftiler\u4e3a\u4e86\u5b9e\u73b0\u57fa\u4e8e\u6570\u636e\u8fde\u63a5\u72b6\u6001\u4fa6\u6d4b\u7684\u72b6\u6001\u9632\u706b\u5899\u529f\u80fd\u548cNAT\u5730\u5740\u8f6c\u6362\u529f\u80fd\u624d\u5f00\u53d1\u51fa\u4e86\u8fde\u63a5\u8ddf\u8e2a\u8fd9\u5957\u673a\u5236\u3002<\/p>\n

\u5982\u679c\u7f16\u8bd1\u5185\u6838\u65f6\u5f00\u542f\u4e86\u8fde\u63a5\u8ddf\u8e2a\u9009\u9879\uff0c\u90a3\u4e48Linux\u7cfb\u7edf\u5c31\u4f1a\u4e3a\u5b83\u6536\u5230\u7684\u6bcf\u4e2a\u6570\u636e\u5305\u7ef4\u6301\u4e00\u4e2a\u8fde\u63a5\u72b6\u6001\u7528\u4e8e\u8bb0\u5f55\u8fd9\u6761\u6570\u636e\u8fde\u63a5\u7684\u72b6\u6001\u3002<\/p>\n

nf_conntrack\/ip_conntrack \u4f1a\u4f7f\u7528\u4e00\u4e2a\u54c8\u5e0c\uff08hash\uff09\u6563\u5217\u8868\u6765\u8bb0\u5f55\u6240\u6709\u6570\u636e\u5305\u8fde\u63a5\u4fe1\u606f\u3002\u5982\u679c\u8be5\u54c8\u5e0c\u8868\u6ee1\u4e86\uff0c\u5c31\u4f1a\u51fa\u73b0\uff1a<\/p>\n

  1. nf_conntrack<\/span>:<\/span> table full<\/span>,<\/span> dropping packet<\/span><\/code><\/li><\/ol><\/pre>\n
    \u6ce8\u610fTIPS<\/strong> 
    \nnf_conntrack \u5de5\u4f5c\u5728 3 \u5c42\uff0c\u652f\u6301 IPv4 \u548c IPv6\uff0c\u800c ip_conntrack \u53ea\u652f\u6301 IPv4\u3002 
    \n\u76ee\u524d\uff0c\u5927\u591a\u7684 ip_conntrack_* \u5df2\u88ab nf_conntrack_* \u53d6\u4ee3<\/p>\n
    \u4e8c\u3001nf_conntrack\u7684\u67e5\u770b<\/h2>\n
    \u67e5\u770b\u5f53\u524d\u7684\u8ddf\u8e2a\u7684\u8fde\u63a5\u548c\u8fde\u63a5\u72b6\u6001\uff1a<\/p>\n
    1. $ cat <\/span>\/<\/span>proc<\/span>\/<\/span>net<\/span>\/<\/span>nf_conntrack<\/span><\/code><\/li>
    2. ipv4     <\/span>2<\/span> tcp      <\/span>6<\/span> <\/span>44<\/span> TIME_WAIT src<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> dst<\/span>=<\/span>221.206<\/span>.<\/span>12.110<\/span> sport<\/span>=<\/span>50721<\/span> dport<\/span>=<\/span>54321<\/span> src<\/span>=<\/span>221.206<\/span>.<\/span>12.110<\/span> dst<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> sport<\/span>=<\/span>54321<\/span> dport<\/span>=<\/span>50721<\/span> <\/span>[<\/span>ASSURED<\/span>]<\/span> mark<\/span>=<\/span>0<\/span> secmark<\/span>=<\/span>0<\/span> <\/span>use<\/span>=<\/span>2<\/span><\/code><\/li>
    3. ipv4     <\/span>2<\/span> tcp      <\/span>6<\/span> <\/span>44<\/span> TIME_WAIT src<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> dst<\/span>=<\/span>220.181<\/span>.<\/span>143.73<\/span> sport<\/span>=<\/span>9804<\/span> dport<\/span>=<\/span>8071<\/span> src<\/span>=<\/span>220.181<\/span>.<\/span>143.73<\/span> dst<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> sport<\/span>=<\/span>8071<\/span> dport<\/span>=<\/span>9804<\/span> <\/span>[<\/span>ASSURED<\/span>]<\/span> mark<\/span>=<\/span>0<\/span> secmark<\/span>=<\/span>0<\/span> <\/span>use<\/span>=<\/span>2<\/span><\/code><\/li>
    4. ipv4     <\/span>2<\/span> tcp      <\/span>6<\/span> <\/span>49<\/span> SYN_SENT src<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> dst<\/span>=<\/span>122.228<\/span>.<\/span>238.168<\/span> sport<\/span>=<\/span>42915<\/span> dport<\/span>=<\/span>873<\/span> <\/span>[<\/span>UNREPLIED<\/span>]<\/span> src<\/span>=<\/span>122.228<\/span>.<\/span>238.168<\/span> dst<\/span>=<\/span>220.181<\/span>.<\/span>43.108<\/span> sport<\/span>=<\/span>873<\/span> dport<\/span>=<\/span>42915<\/span> mark<\/span>=<\/span>0<\/span> secmark<\/span>=<\/span>0<\/span> <\/span>use<\/span>=<\/span>2<\/span><\/code><\/li><\/ol><\/pre>\n
      \u4e09\u3001\u89e3\u51b3nf_conntrack: table full, dropping packet\u7684\u65b9\u6cd5<\/h2>\n
      3.1    \u5378\u8f7d nf_conntrack \u6a21\u5757<\/h3>\n
      \u9996\u5148\u8981\u79fb\u9664 state \u6a21\u5757\uff0c\u56e0\u4e3a\u4f7f\u7528\u8be5\u6a21\u5757\u9700\u8981\u52a0\u8f7d nf_conntrack\u3002 
      \n\u786e\u4fdd iptables \u89c4\u5219\u4e2d\u6ca1\u6709\u51fa\u73b0\u7c7b\u4f3c state \u6a21\u5757\u7684\u89c4\u5219\uff0c\u5982\u679c\u6709\u7684\u8bdd\u5c06\u5176\u79fb\u9664<\/p>\n
      1. -<\/span>A INPUT <\/span>-<\/span>m state <\/span>\u2013<\/span>state RELATED<\/span>,<\/span>ESTABLISHED <\/span>-<\/span>j ACCEPT<\/span><\/code><\/li><\/ol><\/pre>\n
        \u6ce8\u91ca \/etc\/sysconfig\/iptables-config \u4e2d\u7684\uff1a<\/p>\n
        1. IPTABLES_MODULES<\/span>=<\/span>\"ip_conntrack_netbios_ns\"<\/span><\/code><\/li><\/ol><\/pre>\n
          \u79fb\u9664 nf_conntrack \u6a21\u5757\uff1a<\/p>\n
          1. $ sudo modprobe <\/span>-<\/span>r xt_NOTRACK nf_conntrack_netbios_ns nf_conntrack_ipv4 xt_state<\/span><\/code><\/li>
          2. $ sudo modprobe <\/span>-<\/span>r nf_conntrack<\/span><\/code><\/li><\/ol><\/pre>\n
            \u73b0\u5728 \/proc\/net\/ \u4e0b\u9762\u5e94\u8be5\u6ca1\u6709 nf_conntrack \u4e86\u3002<\/p>\n
            3.2    \u8c03\u6574\u5185\u6838\u53c2\u6570<\/h3>\n
            \u53ef\u4ee5\u589e\u5927 conntrack \u7684\u6761\u76ee(sessions, connection tracking entries) CONNTRACK_MAX \u6216\u8005\u589e\u52a0\u5b58\u50a8 conntrack \u6761\u76ee\u54c8\u5e0c\u8868\u7684\u5927\u5c0f HASHSIZE<\/p>\n
            \u5bf9\u4e8e HASHSIZE\uff0c\u9ed8\u8ba4\u7684\u6709\u8fd9\u6837\u7684\u8f6c\u6362\u5173\u7cfb\uff1a 
            \nCONNTRACK_MAX = HASHSIZE * 8 
            \n\u8fd9\u8868\u793a\u6bcf\u4e2a\u94fe\u63a5\u5217\u8868\u91cc\u9762\u5e73\u5747\u6709 8 \u4e2a conntrack \u6761\u76ee\u3002\u5176\u771f\u6b63\u7684\u8ba1\u7b97\u516c\u5f0f\u5982\u4e0b\uff1a 
            \nHASHSIZE = CONNTRACK_MAX \/ 8 = RAMSIZE (in bytes) \/ 131072 \/ (ARCH \/ 32) 
            \n\u6bd4\u5982\u4e00\u4e2a 64 \u4f4d 48G \u7684\u673a\u5668\u53ef\u4ee5\u5b58\u50a8 48*1024^3\/131072\/2 = 196608 \u7684buckets(\u8fde\u63a5\u5217\u8868)\u3002 
            \n\u5bf9\u4e8e\u5927\u4e8e 1G \u5185\u5b58\u7684\u7cfb\u7edf\uff0c\u9ed8\u8ba4\u7684 HASHSIZE \u662f 8192\u3002 
            \n\u53ef\u4ee5\u901a\u8fc7 echo \u76f4\u63a5\u4fee\u6539\u76ee\u524d\u7cfb\u7edf CONNTRACK_MAX \u4ee5\u53ca HASHSIZE \u7684\u503c\uff1a<\/p>\n
            1. $ sudo su <\/span>-<\/span>c <\/span>\"echo 100000 > \/proc\/sys\/net\/netfilter\/nf_conntrack_max\"<\/span><\/code><\/li>
            2. $ sudo su <\/span>-<\/span>c <\/span>\"echo 50000 > \/proc\/sys\/net\/netfilter\/nf_conntrack_buckets\"<\/span><\/code><\/li><\/ol><\/pre>\n
              \u5f53\u7136\u4e3a\u4e86\u4f7f\u91cd\u542f\u80fd\u591f\u751f\u6548\uff0c\u6700\u597d\u52a0\u5728\/etc\/modprobe.d\/nf_conntrack.conf<\/p>\n
              1. options nf_conntrack hashsize<\/span>=<\/span>32768<\/span><\/code><\/li><\/ol><\/pre>\n
                3.3    \u4f7f\u7528 raw \u8868\uff0c\u4e0d\u8ddf\u8e2a\u8fde\u63a5<\/h3>\n
                iptables \u4e2d\u7684 raw \u8868\u8ddf\u5305\u7684\u8ddf\u8e2a\u6709\u5173\uff0c\u57fa\u672c\u5c31\u662f\u7528\u6765\u5e72\u4e00\u4ef6\u4e8b\uff0c\u901a\u8fc7 NOTRACK \u7ed9\u4e0d\u9700\u8981\u88ab\u8fde\u63a5\u8ddf\u8e2a\u7684\u5305\u6253\u6807\u8bb0\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u5982\u679c\u4e00\u4e2a\u8fde\u63a5\u9047\u5230\u4e86 -j NOTRACK\uff0cconntrack \u5c31\u4e0d\u4f1a\u8ddf\u8e2a\u8be5\u8fde\u63a5\uff0craw \u7684\u4f18\u5148\u7ea7\u5927\u4e8e mangle, nat, filter\uff0c\u5305\u542b PREROUTING \u548c OUTPUT \u94fe\u3002 
                \n\u5f53\u6267\u884c -t raw \u65f6\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u52a0\u8f7d iptable_raw \u6a21\u5757(\u9700\u8981\u8be5\u6a21\u5757\u5b58\u5728)\u3002raw \u5728 2.4 \u4ee5\u53ca 2.6 \u65e9\u671f\u7684\u5185\u6838\u4e2d\u4e0d\u5b58\u5728\uff0c\u9664\u975e\u6253\u4e86 patch\uff0c\u76ee\u524d\u7684\u7cfb\u7edf\u5e94\u8be5\u90fd\u6709\u652f\u6301:<\/p>\n
                1. $ sudo iptables <\/span>-<\/span>A FORWARD <\/span>-<\/span>m state <\/span>--<\/span>state UNTRACKED <\/span>-<\/span>j ACCEPT<\/span><\/code><\/li>
                2. $ sudo iptables <\/span>-<\/span>t raw <\/span>-<\/span>A PREROUTING <\/span>-<\/span>p tcp <\/span>-<\/span>m multiport <\/span>--<\/span>dport <\/span>80<\/span>,<\/span>81<\/span>,<\/span>82<\/span> <\/span>-<\/span>j NOTRACK<\/span><\/code><\/li>
                3. $ sudo iptables <\/span>-<\/span>t raw <\/span>-<\/span>A PREROUTING <\/span>-<\/span>p tcp <\/span>-<\/span>m multiport <\/span>--<\/span>sport <\/span>80<\/span>,<\/span>81<\/span>,<\/span>82<\/span> <\/span>-<\/span>j NOTRACK<\/span><\/code><\/li><\/ol><\/pre>\n
                  \u63a8\u8350\u4f7f\u7528\u7b2c\u4e09\u79cd\u65b9\u5f0f\u3002<\/p>\n
                  \u53c2\u8003\u8d44\u6599<\/h2>\n
                  http:\/\/blog.chinaunix.net\/uid-23069658-id-3169450.html<\/a> 
                  \n                  http:\/\/jaseywang.me\/2012\/08\/16\/%E8%A7%A3%E5%86%B3-nf_conntrack-table-full-dropping-packet-%E7%9A%84%E5%87%A0%E7%A7%8D%E6%80%9D%E8%B7%AF\/<\/a> 
                  \n                  https:\/\/www.panwenbin.com\/2010\/09\/05\/procnetip_conntrack\/<\/a> 
                  \n                  http:\/\/www.361way.com\/%E5%86%8D%E7%9C%8Bnf_conntrack-table-full%E9%97%AE%E9%A2%98\/2404.html<\/a><\/p>\n
                  \u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1aIPCPU-\u7f51\u7edc\u4e4b\u8def<\/a> » \u89e3\u51b3nf_conntrack: table full, dropping packet<\/a><\/p>","protected":false},"excerpt":{"rendered":"
                  \u4e00\u3001nf_conntrack\u6982\u8ff0 nf_conntrack \uff08\u8001\u7248\u672c\u540d\u79f0\u53ebip_conntrack\uff09\u662fNetfilter\u6846\u67b6\u91cc\u9762\u7528\u6765\u8bb0\u5f55\u4e00\u4e2a\u6570\u636e\u5305\u548c\u5176\u8fde\u63a5\u5173\u7cfb\u7684\u6a21\u5757\u3002 Neftiler\u4e3a\u4e86\u5b9e\u73b0\u57fa\u4e8e\u6570\u636e\u8fde\u63a5\u72b6\u6001\u4fa6\u6d4b\u7684\u72b6\u6001\u9632\u706b\u5899\u529f\u80fd\u548cNAT\u5730\u5740\u8f6c\u6362\u529f\u80fd\u624d\u5f00\u53d1\u51fa\u4e86\u8fde\u63a5\u8ddf\u8e2a\u8fd9\u5957\u673a\u5236\u3002 \u5982\u679c\u7f16\u8bd1\u5185\u6838\u65f6\u5f00\u542f\u4e86\u8fde\u63a5\u8ddf\u8e2a\u9009\u9879\uff0c\u90a3\u4e48Linux\u7cfb\u7edf\u5c31\u4f1a\u4e3a\u5b83\u6536\u5230\u7684\u6bcf\u4e2a\u6570\u636e\u5305\u7ef4\u6301\u4e00\u4e2a\u8fde\u63a5\u72b6\u6001\u7528\u4e8e\u8bb0\u5f55\u8fd9\u6761\u6570\u636e\u8fde\u63a5\u7684\u72b6\u6001\u3002 nf_conntrack\/ip_conntrack \u4f1a\u4f7f\u7528\u4e00\u4e2a\u54c8\u5e0c\uff08hash\uff09\u6563\u5217\u8868\u6765\u8bb0\u5f55\u6240\u6709\u6570\u636e\u5305\u8fde\u63a5\u4fe1\u606f\u3002\u5982\u679c\u8be5\u54c8\u5e0c\u8868\u6ee1\u4e86\uff0c\u5c31\u4f1a\u51fa\u73b0\uff1a nf_conntrack: table full, dropping packet \u6ce8\u610fTIPS nf_conntrack \u5de5\u4f5c\u5728 3 \u5c42\uff0c\u652f\u6301 IPv4 \u548c IPv6\uff0c\u800c ip_conntrack \u53ea\u652f\u6301 IPv4\u3002 \u76ee\u524d\uff0c\u5927\u591a\u7684 ip_conntrack_* \u5df2\u88ab nf_conntrack_* \u53d6\u4ee3 \u4e8c\u3001nf_conntrack\u7684\u67e5\u770b \u67e5\u770b\u5f53\u524d\u7684\u8ddf\u8e2a\u7684\u8fde\u63a5\u548c\u8fde\u63a5\u72b6\u6001\uff1a $ cat \/proc\/net\/nf_conntrackipv4 2 tcp 6 44 TIME_WAIT src=220.181.43.108 dst=221.206.12.110 sport=50721 dport=54321 src=221.206.12.110 dst=220.181.43.108 sport=54321 dport=50721 [ASSURED] mark=0 secmark=0 use=2ipv4 2 tcp 6 44 TIME_WAIT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[48],"_links":{"self":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/476"}],"collection":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/comments?post=476"}],"version-history":[{"count":0,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/476\/revisions"}],"wp:attachment":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/media?parent=476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/categories?post=476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/tags?post=476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}