[tproxy] Conntrack entries not decreasing
hidden at balabit.hu
Tue Jun 21 11:02:54 CEST 2005
2005-06-21, k keltezéssel 11.35-kor Mohammed Riyaz ezt írta:
> > Yes, this is probably a bug in tproxy. Could you post the contents of
> > the /proc/net/tproxy file?
> The server crashed yesterday once more in the evening. This time we have
> been monitoring the server and the logs clearly show the increase in
> conntrack entries.
Do you have any patches applied on 2.6.10 apart from tproxy? Vanilla
2.6.10 had a TCP connection tracking bug which caused some TCP
connections linger in the conntrack table for way too much time. Please
take a look at the original tproxy for 2.6.10 announcement in the
mailing list archives:
The netfilter-devel post with the patch was:
> The box has 512MB ram and the max conntrack value is set to 32000
Although this value depends on your traffic pattern, I'd say 32000 is
a bit too low for a dedicated squid proxy. With 512MB RAM you could
safely set that to a higher value (64k for example).
> This is the contents of the /proc/net/tproxy taken today morning.
Nothing suspicious here, so I'd wait for your experience with the
2.6.10 TCP conntrack patch.
More information about the tproxy