sudo sysctl -w net.netfilter.nf_conntrack_max=262144raise the limit
Overview
The kernel tracks the state of network connections (conntrack) — this is what
statefulfirewall rules (ESTABLISHED,RELATED) and NAT rely on.
conntrack (package conntrack-tools) shows and clears this table.
bash
sudo conntrack -L # currently tracked connections
cat /proc/sys/net/netfilter/nf_conntrack_count # how many entries right now
cat /proc/sys/net/netfilter/nf_conntrack_max # the limit
Options
11
Flag
Meaning
-L
list connections (the tracking table)
-E
real-time event stream
-S
per-CPU statistics (drops, insert_failed)
-D
delete entries (matching a filter)
-p / --dport / -s / -d
filter: protocol / port / source / destination
--state
filter by state (ESTABLISHED, TIME_WAIT…)
Option
What it does
Example
-L--dump
List tracked connections (the conntrack table).
sudo conntrack -L
-E--event
Stream conntrack events in real time.
sudo conntrack -E
-S--stat
Per-CPU statistics — dropped and failed-insert entries.
sudo conntrack -S
-C--count
Count of entries in the table (same as nf_conntrack_count).
sudo conntrack -C
-D--delete
Delete entries matching the filter (resets those connections). dangerous
sudo conntrack -D -s 10.0.0.5
-p--prototcp|udp|icmp
Filter by protocol.
sudo conntrack -L -p tcp
--dportport
Filter by destination port.
sudo conntrack -L -p tcp --dport 443
-s--srcaddress
Filter by source address.
sudo conntrack -L -s 10.0.0.5
--statestate
Filter by connection state (ESTABLISHED, TIME_WAIT, …).
sudo conntrack -L --state ESTABLISHED
-F--flush
Flush the entire connection table at once. dangerous
sudo conntrack -F
-d--dstaddress
Filter by destination address.
sudo conntrack -L -d 10.0.0.5
Nothing found. Try a shorter query.
Recipes
1
Commands
bash
sudo conntrack -L # list connections
sudo conntrack -L -p tcp --dport 443 # filter by protocol/port
sudo conntrack -L -s 10.0.0.5 # by source
sudo conntrack -L --state ESTABLISHED # established only
sudo conntrack -E # real-time events (like watch)
sudo conntrack -E -e NEW # new connections only
sudo conntrack -S # stats: drops / insert_failed per CPU
sudo conntrack -C # entry count (= nf_conntrack_count)
sudo conntrack -D -s 10.0.0.5 # delete a source's entries (reset its connections)
sudo conntrack -F # flush the WHOLE table (careful)
Troubleshooting
5
SymptomCause and fix
nf_conntrack: table full, dropping packet
The table is full (a busy gateway/NAT) — new connections get dropped.
Raise the limit (sysctl) and check whether thousands of half-open
connections are hanging around (DoS/a leaking client):
conntrack -L shows whether there's a connection entry and its state.
Asymmetric routing breaks conntrack (the reply bypasses the node doing the
tracking).
A connection "stuck" after changing firewall rules
Existing connections are already in the table (ESTABLISHED) and bypass the new
rules. Reset the relevant ones: sudo conntrack -D -s IP (by address/port).
High insert_failed in conntrack -S
Races/overflow under a large number of concurrent connections; check the limit
and timeouts (/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_*).
Where to see current connections without conntrack
Local application sockets — ss; the kernel's tracking itself (for
NAT/firewall) — conntrack -L.