Conntrack tales - one thousand and one flows

This post delves into the intricacies of Linux's 'conntrack' subsystem, a critical component for stateful firewalling and network security. It explains how 'conntrack' tracks network connections and highlights the potential for performance degradation and packet loss when the 'conntrack' table becomes full. The post details experimental methods for testing 'conntrack' behavior, demonstrating that exceeding its capacity can lead to silent packet drops and even application errors like EPERM, without explicit firewall rules. This deep dive into low-level network behavior is crucial for understanding and optimizing the performance and reliability of Cloudflare's security infrastructure.