He could have meant iptables state tracking, which can often overflow in the face of high traffic/connection rates. 1. Don't use connection tracking 2. If you

He could have meant iptables state tracking, which can often overflow in the face of high traffic/connection rates. 1. Don't use connection tracking 2. If you need to use it, make judicious use of -j NOTRACK I use this on a few high traffic servers, with good results: iptables -t raw -A PREROUTING -i lo -j NOTRACK iptables -t raw -A OUTPUT -o lo -j NOTRACK iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 443 -j NOTRACK iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -j NOTRACK