Connection Tracking Calculator
Calculate conntrack table size needed for a firewall or NAT gateway's connection load.
About Connection Tracking Calculator
Netfilter's connection tracking subsystem (conntrack) maintains a table entry for every connection passing through a system using stateful firewalling, NAT, or many container networking setups, and this table has a hard ceiling set by nf_conntrack_max — once full, new connections are dropped or rejected rather than tracked. Each entry consumes kernel memory (roughly a few hundred bytes depending on protocol and extensions tracked), and long default timeouts — especially the notoriously long 5-day TCP ESTABLISHED timeout — mean idle-but-not-closed connections can accumulate and consume table capacity long after they're practically dead.
Formula
Conntrack utilization and memory
utilization% = current_entries / nf_conntrack_max × 100; memory = entries × ~300 bytes
- E
- current conntrack entries
- E_{max}
- nf_conntrack_max
- b
- bytes per entry
Worked example
With the default values below, Connection Tracking Calculator returns Conntrack Table Utilization % of 45.78%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Current Conntrack Entries (conntrack -C)minimum 0
- 120,000
- nf_conntrack_maxminimum 1
- 262,144
- Memory per Entry (bytes)minimum 1
- 300
- TCP Established Timeout (sec)minimum 1
- 432,000
Results
- Conntrack Table Utilization %
- 45.78%
- Status
- Healthy
- Estimated Conntrack Memory (MB)
- 34.33
- TCP Established Timeout (hours)
- 120.0
Step by step
- 1Values used
- 2Conntrack utilization and memory
- 3Conntrack Table Utilization %= 45.78
- 4Status= Healthy
- 5Estimated Conntrack Memory (MB)= 34.33
- 6TCP Established Timeout (hours)= 120.0
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How do I check current conntrack usage and the configured maximum?
`cat /proc/sys/net/netfilter/nf_conntrack_count` shows current entries; `cat /proc/sys/net/netfilter/nf_conntrack_max` shows the ceiling. `conntrack -L | wc -l` lists (and counts) entries in detail if the conntrack tools package is installed.
What happens when the conntrack table fills up?
The kernel logs 'nf_conntrack: table full, dropping packet' and refuses to track (and thus typically drops) new connections until entries expire or are evicted — this is a common, often overlooked cause of intermittent connection failures on busy firewalls, load balancers, and NAT gateways.
Why is the default TCP ESTABLISHED timeout so long (5 days)?
It's intentionally conservative to avoid prematurely dropping tracking state for legitimate long-lived idle connections (e.g. persistent database connections, SSH sessions), but on high-churn systems this default can let stale entries accumulate — tuning `nf_conntrack_tcp_timeout_established` lower is a common mitigation alongside raising nf_conntrack_max.