Linux Server / Performance, Capacity & Containers
Check connection-tracking pressure on a Linux gateway or container host
A gateway can drop new tracked flows when its conntrack table is exhausted. Inspect counters in the correct network context.
Environment and inputs: Linux server baseline · Ubuntu 24.04 LTS / RHEL 9-style systems. Use the specified distribution, init system and installed tool; service names, privileges and supported options can differ.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_maxRead the result
On a host with the relevant netfilter functionality loaded, these report current count and configured capacity. Missing keys can reflect a different setup.
Resolve and verify
Correlate occupancy and kernel messages with traffic patterns, timeout policy and memory headroom. Correct excessive churn or plan a justified capacity adjustment.
Before changing production
Do not flush all tracked connections or raise capacity indefinitely; active traffic and memory use can be affected.