WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] ip conntrack table full

On Mon, Jan 25, 2010 at 7:00 AM, Mike McGrath <mmcgrath@xxxxxxxxxx> wrote:
> Ok, that is a good indicator.  I can see things contacting port 443, which
> is what should be on the domU.  I'm also seeing lots of established
> connections that aren't showing up in netstat.  So it's like the dom0 is
> tracking the domU's iptables, but is not releasing them?

Have you look at each domU's conntrack count (assuming they also have
iptables enabled)? Most likely if you add up all of them it'd match
dom0's count.

If the load is what you expect (i.e. no portscan/attacks), and you
don't use dom0 as firewall (just a router), then perhaps you should
simply just disable iptables on dom0. Another alternative is to
increase max conntrack, or reduce conntrack timeouts on dom0.

-- 
Fajar

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users