Skip to content
Ruachost Help Center

Conntrack sessions

Conntrack sessions
Learn what conntrack sessions are, why they matter, and how to monitor them on your server.

This article explains conntrack (“connection tracking”) sessions, their importance, and how to monitor them.

About conntrack sessions
The Linux kernel includes a networking feature called conntrack, which tracks all incoming and outgoing connections (sessions) on the server.

Maintaining a reasonable number of conntrack sessions is essential. Excessive sessions can cause performance problems and may negatively affect other servers on the same node. To prevent issues, ruachost.com may suspend servers with a sustained high number of conntrack sessions, ensuring all customer servers remain functional.

Typically, a VPS should not exceed about 10,000 sessions at once, though brief spikes above this number may occur during peak usage.

Monitoring conntrack sessions
To check the current number of conntrack sessions on your server:

  1. Log in via SSH.
  2. As the root user, run:
cat /proc/net/nf_conntrack | wc -l

What to do if the number of conntrack sessions is high
If your server exceeds 10,000 sessions, take the following proactive steps to avoid suspension, as a high session count may indicate a compromise:

  • Change the server’s root password.
  • Use SSH keys instead of passwords and disable root SSH login.
  • Monitor resource usage for suspicious programs.

If your server has already been suspended due to excessive conntrack sessions, open a support ticket at https://ruachost.com for assistance.