主题:【求助】关于网站大量 Error 001 应对 -- 铁手
3641788 复 3638751
28.07.09 at 10:19
Some readers may be interested to know what ip_conntrack is in the first place, and why it fills up. If you run an iptables firewall, and have rules that act upon the state of a packet, then the kernel uses ip_conntrack to keep track of what state what connections are in so that the firewall rule logic can be applied against them. If you have a system that's getting a lot of network activity (high rates of connections, lots of concurrent connections, etc) then the table will accumulate entries.
The entries remain until an RST packet is sent from the original IP address. If you have a flaky network somewhere between you, and the clients accessing your server, it can cause the RST packets to be dropped due to the packet loss, and leave orphaned entries in your ip_conntrack table. This can also happen if you have a malfunctioning switch or NIC card... not necessarily a routing problem out on the internet somewhere.
Typically when I've seen this trouble crop up is when a server is the target of a DDoS attack. Filling up the ip_conntrack table is a relatively easy way to knock a server off line, and attackers know this.
As Major suggested, you can get short term relief by increasing the size of the table. However, these entries are held in memory by the kernel. The bigger you make the table, the more memory it will consume. That memory could be used by your server to serve requests if you really don't need the stateful firewall capability. Don't waste resources on this feature if you really don't need it.
Another option to consider is turning OFF iptables rules that use ip_conntrack so the state able is not used at all. Anything with "-m state" or "-t nat" can be turned off. If you want to just flush all your iptables rules you can do an "iptables -P" to set a default allow policy and "iptables -F" to flush all the rules. On an RHEL or CentOS system you can just do "service iptables stop".
Once iptables is no longer using ip_conntrack, you can reclaim the memory the table was using by unloading the related kernel modules.
Then you will have an empty ip_conntrack that will stay empty. I mention this because a lot of sysadmins have hordes of iptables rules installed as a matter of course, and don't recognize the downside of having them present. You can still use iptables, but to avoid the use of ip_conntrack simply don't use rules based on stateful logic.
man iptables 查看 --ctstate 内容，如果防火墙没有依赖这些东西，可以把内核关于 ip_conntrack 的模块黑名单了。
 相关回复：上下关系【求助】关于网站大量 Error 001 应对 75 铁手 字1278 2012-01-01 01:19:41
． 不知道用没用过这个 liuyanzhen 字279 2012-01-06 13:07:05
． ip_conntrack 2 子功能 字2826 2012-01-05 05:02:33
． 简单 1 liuyanzhen 字169 2012-01-03 23:05:57
． 说点题外话 曾自洲 字164 2012-01-03 20:21:17
． 老铁新年快乐！ 两只老虎 字14 2012-01-02 14:36:58
． 给个情况老大参考下 1 有生于无 字134 2012-01-02 14:36:56
． 近几天还好。 njyd 字0 2012-01-02 09:01:36