Performance Tuning & Kernel Parameters (Sysctl)

Stop your kernel from flushing connection tracking early

🧩 The Challenge

Dealing with a massive jump in traffic that causes your firewall to dump active connections is a total nightmare. I’ve wasted whole afternoons wondering why my users keep getting connection reset errors when the box wasn’t even under heavy CPU load.

💡 The Fix

Increase the nf_conntrack_max value and bump up the timeout settings to keep your state table from purging entries prematurely. It keeps your sessions alive when things get spiky.

sysctl -w net.netfilter.nf_conntrack_max=262144
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400

⚙️ Why It Works

By raising the max entries allowed in the tracking table, you prevent the kernel from tossing out old connections just to make room for new ones. You are essentially giving the network stack more breathing room to handle high-concurrency workloads.

🚀 Pro-Tip: Check /proc/sys/net/netfilter/nf_conntrack_count to see if you are actually near your current limit before you start tuning.

Linux Tips & Tricks | © ngelinux.com | 11/14/2026