Linux includes a module for tracking IP connections called ip_conntrack. However, the capacity of this table is limited and generally depends on available memory.
When there are too many connections, the system may report an error: ip_conntrack: table full, dropping packet. You can resolve this by modifying /proc/sys/net/ipv4/netfilter/ip_conntrack_max;
Sometimes, you might find that this directory does not exist under /proc. This is usually due to improper module loading, and the module names differ between RHEL 5 and RHEL 6
You can modify /etc/sysctl.conf and then run sysctl -p to apply the changes.
RHEL 6 Series
modprobe nf_conntrack
net.nf_conntrack_max = 655360
net.netfilter.nf_conntrack_tcp_timeout_established = 36000
RHEL 5 Series
modprobe ip_conntrack
net.ipv4.ip_conntrack_max = 655350
The maximum number of “tasks” (connection tracking entries) netfilter can handle simultaneously in kernel memory:
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 10800
Timeout duration for tracked connections before they are considered expired.
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 10800
Timeout duration for tracked connections before they are considered expired.