Linux下nf_conntrack（最全面）

版权声明：未经许可不得转载 https://blog.csdn.net/qq_35299863/article/details/79530732

总结如下：

dmesg |grep nf_conntrack

连接跟踪表nf_conntrack：如果输出值中有“nf_conntrack: table full, dropping packet”，说明服务器nf_conntrack表已经被打满

如果服务器上跑着iptables，必须使用的情况下：

1:高并发服务器内核调整(8核16G为例，不懂请自行百度)：

net.nf_conntrack_max = 8388608

net.netfilter.nf_conntrack_generic_timeout = 120

net.netfilter.nf_conntrack_tcp_timeout_established = 54000

模版：

net.ipv4.ip_forward = 1

net.ipv4.conf.default.accept_source_route = 0

扫描二维码关注公众号，回复： 3937915 查看本文章

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.bridge.bridge-nf-call-ip6tables = 0

net.bridge.bridge-nf-call-iptables = 0

net.bridge.bridge-nf-call-arptables = 0

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

vm.swappiness = 0

net.ipv4.tcp_fin_timeout = 10

net.ipv4.tcp_keepalive_time = 1200

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.neigh.default.gc_stale_time=120

net.ipv4.conf.all.rp_filter=0

net.ipv4.conf.default.rp_filter=0

net.ipv4.conf.default.arp_announce = 2

net.ipv4.conf.all.arp_announce=2

net.ipv4.tcp_max_tw_buckets = 90000

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_max_syn_backlog = 2048

net.ipv4.tcp_synack_retries = 2

net.ipv4.conf.lo.arp_announce=2

net.nf_conntrack_max = 8388608

net.netfilter.nf_conntrack_generic_timeout = 120

net.netfilter.nf_conntrack_tcp_timeout_established = 54000

其他：

net.ipv4.ip_local_port_range = 10000 65000

net.core.somaxconn = 262144

同时增加iptables规则（80端口为例）：

*raw表下：

-A PREROUTING -p tcp -m tcp --dport 80 -j NOTRACK

-A OUTPUT -p tcp -m tcp --sport 80 -j NOTRACK

-A PREROUTING -p tcp -m tcp --sport 80    -j NOTRACK

-A OUTPUT -p tcp -m tcp --dport 80    -j NOTRACK

同时修改iptables配置文件

vim /etc/sysconfig/iptables-config 

IPTABLES_MODULES_UNLOAD="no"

二：这种方法比较彻底：直接卸载模块