# Networking: kernel: nf_conntrack: table full, dropping packet — new connections fail on a Linux firewall/NAT host

**Code:** `nf_conntrack: table full, dropping packet` · **Category:** Networking · **Seen on:** Linux, Kubernetes, Networking

The connection-tracking table is full, so the kernel drops packets for any new connection.

## Meaning

Busy NAT gateways, Kubernetes nodes and servers hitting `nf_conntrack_max` start dropping new flows (timeouts, intermittent resets). Raise `net.netfilter.nf_conntrack_max` (and the hash size), shorten established/TIME_WAIT timeouts, bypass tracking for heavy flows (`NOTRACK`), and reduce connection churn.

## Common causes

- `nf_conntrack_max` too low for the load
- Connection churn or scanning/DDoS traffic
- Long conntrack timeouts
- Kubernetes node with many pods/services
- UDP/DNS floods creating entries

## Quick fix

1. Compare `nf_conntrack_count` and `nf_conntrack_max`
2. Raise the max and shorten the timeouts
3. Use NOTRACK for high-volume flows

## Detailed fix by platform

### Linux

1. 

```bash
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max
sudo sysctl -w net.netfilter.nf_conntrack_max=524288
```


## How to diagnose

1. **count vs max** — Near full?
2. **Source** — Churn or attack?
3. **Timeouts** — Too long?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/conntrack-table-full-dropping-packet)