Re: Confirming conntrack behavior on environments with multiple network namespaces

Antonio Ojea <[email protected]> wrote:
> interesting, just to confirm, can I approximate the load factor using
> active_objects / buckets, with
> 
> active_objects=$(sudo awk '$1 == "nf_conntrack" {print $2}' /proc/slabinfo)
> buckets=$(cat /proc/sys/net/netfilter/nf_conntrack_buckets)

Yes, but keep in mind that each entry is hashed twice, once for original
direction and once for reply.

The active_objects count will be higher than what ends up in the table
(e.g., if first packet of connection is dropped it is never inserted).

But it should be a good estimate.