Network & Infrastructure / Linux Networking & Host Performance
Conntrack exhaustion and failures unrelated to link bandwidth
New flows fail on a Linux gateway while existing traffic continues. The connection-tracking table can be full even when CPU and interface utilization look acceptable.
Environment and inputs: Linux network namespaces, host routing and network drivers; availability and semantics depend on kernel and driver versions. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Collect allocation failures, current and maximum tracked entries, state distribution and flow creation rate. Identify traffic retaining entries rather than assuming every entry represents an active useful session.
Explain the result
State capacity is a separate resource from bandwidth. Increasing a table limit consumes memory and may not solve abusive churn or unnecessarily long retention.
Plan the fix
Address the dominant flow pattern and size supported tracking capacity with memory headroom. Review timeout changes against actual application idle behavior and required NAT state.
Check the result and rollback
Exercise peak new-flow load and idle recovery while tracking memory and failed allocations. Restore previous limits if memory pressure grows or valid long-lived sessions begin failing.