In this lesson, you will learn how to optimize the Linux kernel’s connection tracking (conntrack) system to prevent packet drops and latency in high-traffic firewall environments.
Understanding the Conntrack Table
The netfilter connection tracking system maintains a state table to track every active network connection. Each entry consumes kernel memory. When your firewall processes millions of packets, this table can fill up, leading to the infamous nf_conntrack: table full, dropping packet error in your dmesg logs. To scale, you must tune two specific aspects: the size of the hash table and the duration of connection timeouts.
Adjusting Hash Table Size
The hashsize determines how many buckets are available for connection entries. If the number of tracked connections far exceeds the hash size, lookups become inefficient, increasing CPU overhead. You can check your current limit and size via:
# Check current max entries
sysctl net.netfilter.nf_conntrack_max
# Check current hash table size
cat /sys/module/nf_conntrack/parameters/hashsize
If you need to increase these, you should do so via kernel module parameters at boot, as the hash table size is often allocated during module initialization. You can add a file to /etc/modprobe.d/nf_conntrack.conf:
options nf_conntrack hashsize=262144
Tuning Timeouts
By default, the kernel keeps connections in the table long after they have stopped sending data. For high-volume servers, you can aggressively reclaim memory by shortening these timeouts. For example, reducing the timeout for established TCP connections helps purge "ghost" entries faster:
# Reduce TCP established timeout from default (432000s) to 1 hour
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600
This prevents the table from being clogged with idle connections, ensuring that space is always available for new, legitimate traffic flows. When tuning, always monitor your memory usage (slabtop) to ensure the increase in nf_conntrack_max does not starve other kernel processes of RAM.
Key Takeaway: To handle high-volume traffic, balance your nf_conntrack_max capacity against your available RAM and aggressively tune connection timeouts to ensure the state table remains lean and performant.