Fedora / ip_conntrack_max

[Bill Petersen <bill.petersen () alcatel com>]

I am running nmap 3.93 on a Fedora 4 system (latest patches) with 4GB 
RAM and a 2.8GB CPU.
When I am running some large network scans I sometimes see
kernel: ip_conntrack: table full, dropping packet

I assume this is not good.  I am loosing data and so my nmap results 
will be wrong.

So I google the network looking for hints.  I see that I can increase 
this param, so
I do:  echo "125000" >/proc/sys/net/ipv4/ip_conntrack_max

This seems to be good, until I try
cat /proc/net/ip_conntrack | wc -l

and get:
cat: /proc/net/ip_conntrack: No space left on device

I don't see a real filesystem associated with this, so I suppose it is a 
RAM based table?
df does not show anything useful.

Now what!
The only solution I can find is to turn off iptables

service iptables stop

Now I loose all of the stats, and of course my firewall is down, which 
leaves me a little vulnerable - not too bad since the
only external service is SSH, but still, I'd rather have iptables running.

Any suggestions on actions I could try?

I am running nmap in 'normal' mode.
All other conntrack parameters are default.


Help!


--
Bill Petersen, CISSP
Senior Information Security Analyst
Alcatel North America Information Security
Bill.Petersen () alcatel com
Voice: 972-519-4249
Fax:   972-477-5300



_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev