[root@centos ~]# modprobe ip_conntrack
In other operating systems like Debian or Ubuntu Server, first of all you must install the conntrack package and load the nf_conntrack_ipv4 module (if you want to work with IPv6, you will have to load the nf_conntrack_ipv6 module).
root@ubuntu-server:~# aptitude install conntrack root@ubuntu-server:~# modprobe nf_conntrack_ipv4
The conntrack module allows the kernel to register in a table all network connections of the system (established, time_wait, close, etc.). It used by several applications such as iptstate (it shows information about the state of the system connections) or Shorewall (firewall).
Another example of use for this module it is for instance, when the server has to realize NAT tasks with iptables and it is necessary to keep a table of connections implicated.
The file where conntrack logs all connections is /proc/net/ip_conntrack.
root@ubuntu-server:~# cat /proc/net/ip_conntrack tcp 6 89 TIME_WAIT src=192.168.1.11 dst=192.168.1.12 sport=59302 dport=10050 packets=5 bytes=291 src=192.168.1.12 dst=192.168.1.11 sport=10050 dport=59302 packets=5 bytes=289 [ASSURED] mark=0 secmark=0 use=1 ... root@ubuntu-server:~# conntrack -L tcp 6 89 TIME_WAIT src=192.168.1.11 dst=192.168.1.12 sport=59302 dport=10050 packets=5 bytes=291 src=192.168.1.12 dst=192.168.1.11 sport=10050 dport=59302 packets=5 bytes=289 [ASSURED] mark=0 secmark=0 use=1 ...
The two first fields are the connection protocol (TCP, 6) and then is the connection state (TIME_WAIT). The rest of the fields represent the IP addresses and ports involved, as well as the number of packets and bytes exchanged between the two points of the connection.
You have also to take into account that Linux saves the connection state in memory, and each of them uses around 350 bytes.
If you want to know how many open connections has got the system, you can utilize the following sentences.
root@ubuntu-server:~# cat /proc/net/ip_conntrack | wc -l 856 root@ubuntu-server:~# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count 856 root@ubuntu-server:~# conntrack -C 856
This value is quite important because if at any moment we appreciate that any of our services works slowly (for instance Apache) or many connections are rejected, it can be due to which the number of open connections exceeds the maximum number of connections allowed.
root@ubuntu-server:~# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max 65536
The size of the hash table is also limited.
root@ubuntu-server:~# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_buckets 16384
If you want to modify it, you must do it when the module is loaded.
root@ubuntu-server:~# modprobe nf_conntrack_ipv4 hashsize=32768