conntrack table full -- nf_conntrack: table full, dropping packet

Symptoms

• dmesg shows 'nf_conntrack: table full, dropping packet'
• Intermittent packet drops and connection failures on a busy server
• Connections established before the drop window work, new connections fail

Every NAT'd connection consumes a conntrack entry. On high-traffic NAT gateways or load balancers, the default 262144 entries can fill in seconds. Always size conntrack_max based on expected concurrent connections.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

• Current conntrack utilization

  Copy
  sysctl net.netfilter.nf_conntrack_count && sysctl net.netfilter.nf_conntrack_max

• Kernel drop counter

  Copy
  dmesg | grep -i 'conntrack|table full' | tail -10

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

Prevention

• Set nf_conntrack_max to at least 4x the expected concurrent connections.
• Monitor nf_conntrack_count / nf_conntrack_max and alert at 80% utilization.
• Reduce TCP timeout values for states that shouldn't persist (CLOSE_WAIT, TIME_WAIT).
• Use nf_conntrack_audit=1 temporarily to identify what's consuming entries during an incident.