Conntrack table full check troubleshooting
Count tracked flows vs limit; -S shows insert_failed/drop when table full
conntrack -L 2>/dev/null | wc -l; conntrack -S
more troubleshooting
all 32 commands →
Conntrack live events
conntrack -E -p tcp --dport 443 -o timestamp
Ephemeral port exhaustion
ss -tan state time-wait | wc -l; sysctl net.ipv4.ip_local_port_range
Socket summary stats
ss -s; ss -tan state syn-sent | wc -l
Path MTU discovery
tracepath -n <host>; ping -M do -s 1472 -c2 <host>
Confirm egress route and ARP
ip route get <ip>; ip neigh show | grep -E 'FAILED|INCOMPLETE'