nf_conntrack: table full, dropping packet 错误解决

cat /var/log/messages | more
看系统日志发现大量的 nf_conntrack: table full, dropping packet. 错误
Jun 7 09:52:05 localhost kernel: nf_conntrack: table full, dropping packet.
Jun 7 09:52:05 localhost kernel: nf_conntrack: table full, dropping packet.
Jun 7 09:52:05 localhost kernel: nf_conntrack: table full, dropping packet.
解决办法:
vi /etc/sysctl.conf
加入:
net.nf_conntrack_max = 655350
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
CENTOS 6.1或以上版本使用:
net.netfilter.nf_conntrack_max = 655350
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
保存后执行 sysctl -p 使之生效,然后观察该错误是不是没有了。

修改文件 /etc/sysctl.conf

net.nf_conntrack_max = 655360
net.netfilter.nf_conntrack_max = 655350
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
另外发现连接有大量TIME_WAIT状态,所以也添加以下参数一起解决:

net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_fin_timeout = 30
net.core.netdev_max_backlog =8096

留下评论

鄂ICP备13000209号-1

鄂公网安备 42050602000277号