| |
|
 |
|
 |
|
|
|
| |
|
|
xen-users
[Xen-users] Re: ip conntrack table full
"Fajar A. Nugraha" <fajar@xxxxxxxxx> writes:
> On Mon, Jan 25, 2010 at 7:00 AM, Mike McGrath <mmcgrath@xxxxxxxxxx> wrote:
>
>> Ok, that is a good indicator. I can see things contacting port 443, which
>> is what should be on the domU. I'm also seeing lots of established
>> connections that aren't showing up in netstat. So it's like the dom0 is
>> tracking the domU's iptables, but is not releasing them?
>
> Have you look at each domU's conntrack count (assuming they also have
> iptables enabled)? Most likely if you add up all of them it'd match
> dom0's count.
>
> If the load is what you expect (i.e. no portscan/attacks), and you
> don't use dom0 as firewall (just a router), then perhaps you should
> simply just disable iptables on dom0. Another alternative is to
> increase max conntrack, or reduce conntrack timeouts on dom0.
Or zero out /proc/sys/net/bridge/bridge-nf-call-iptables on dom0.
--
Feri.
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
| |
|
Home