nf_conntrack: table full, dropping packet

tail /var/log/messages

Aug  4 14:58:33 WEB1 kernel: [1981035.456720] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456727] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456734] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456739] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456745] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456750] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456756] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456762] nf_conntrack: table full, dropping packet.

Aug  4 14:58:33 WEB1 kernel: [1981035.456768] nf_conntrack: table full, dropping packet.

解决办法：在/etc/sysctl.conf中加入：

net.ipv4.netfilter.ip_conntrack_max = 655350

net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 1200