Calculate conntrack table size needed for a firewall or NAT gateway's connection load.
Netfilter's connection tracking subsystem (conntrack) maintains a table entry for every connection passing through a system using stateful firewalling, NAT, or many container networking setups, and this table has a hard ceiling set by nf_conntrack_max — once full, new connections are dropped or rejected rather than tracked. Each entry consumes kernel memory (roughly a few hundred bytes depending on protocol and extensions tracked), and long default timeouts — especially the notoriously long 5-day TCP ESTABLISHED timeout — mean idle-but-not-closed connections can accumulate and consume table capacity long after they're practically dead.
Conntrack utilization and memory
utilization% = current_entries / nf_conntrack_max × 100; memory = entries × ~300 bytes
`cat /proc/sys/net/netfilter/nf_conntrack_count` shows current entries; `cat /proc/sys/net/netfilter/nf_conntrack_max` shows the ceiling. `conntrack -L | wc -l` lists (and counts) entries in detail if the conntrack tools package is installed.
The kernel logs 'nf_conntrack: table full, dropping packet' and refuses to track (and thus typically drops) new connections until entries expire or are evicted — this is a common, often overlooked cause of intermittent connection failures on busy firewalls, load balancers, and NAT gateways.
It's intentionally conservative to avoid prematurely dropping tracking state for legitimate long-lived idle connections (e.g. persistent database connections, SSH sessions), but on high-churn systems this default can let stale entries accumulate — tuning `nf_conntrack_tcp_timeout_established` lower is a common mitigation alongside raising nf_conntrack_max.