Re: Confirming conntrack behavior on environments with multiple network namespaces

On Tue, 23 Sept 2025 at 19:07, Florian Westphal <[email protected]> wrote:
>
> Antonio Ojea <[email protected]> wrote:

>
> > I was surprised to find that reading
> > /proc/sys/net/netfilter/nf_conntrack_count from the root namespace
> > (init_net) returns the global sum of all entries. Reading the same
> > file from inside a pod's namespace returns the per-namespace count.
>
> No, its always per namespace, even in init_net.

heh, my bad, I had a bug in the script I used for testing and this
makes more sense, thanks for clarifying

> Try not enabling conntrack in init_net.

> Or add 'notrack' rules in init_net for the netns originating traffic.
> Or create a netns, enable conntrack and then only create connections
> to addresses reachable via loopback. In all these cases init_net won't
> be affected by the net namespace.

It will be hard to disable conntrack in init_net, a lot of
functionality relies on NAT in kubernetes and is not owned by the same
component

>
> That will only monitor that namespace, I'm not aware of a global counter.
>

Can this be a feature request? having a global counter can easily
monitor the load factor of the system, but I'm not familiar with
kernel conventions and having some global counter may be discouraged