Conntrack tales - one thousand and one flows
4/6/2020
This post details the internal investigation into Linux's conntrack subsystem. It explains what conntrack is, how it tracks connection states, its configurable limits (e.g., /proc/sys/net/nf_conntrack_max), and the challenges in testing it, particularly within containerized environments using 'unshare'. The post demonstrates how conntrack overfilling leads to silent packet drops (specifically SYN packets) and EPERM errors for new UDP flows, highlighting the critical need to manage conntrack capacity. It also touches upon the 'strict' vs. 'loose' modes and scenarios where conntrack entries are not created (e.g., packets hitting a DROP target).