bench: a cell measured while the conntrack table was full is discarded

bench/README.md

@@ -32,7 +32,12 @@ going. A cell is **discarded rather than reported** when
 - the sample served a different byte count than the row asks for,
 - more than one process is listening on the port. Under `SO_REUSEPORT` a leaked server from an
   earlier run will happily bind alongside the new one and take half the load, which has produced
-  phantom numbers here before.
+  phantom numbers here before,
+- the connection-tracking table filled up. With `nf_conntrack` loaded (Docker loads it) every
+  connection keeps an entry for 120 s after closing, and a full table drops new connections
+  silently, so a run that opens connections faster than that stalls. Ad-hoc connection-churn
+  tests hit it within seconds when every run uses new ports or addresses; reusing one port and a
+  few addresses lets the entries recycle.
 
 A number from a broken fixture is worse than no number.
 

bench/any.sh

@@ -252,6 +252,8 @@ while read -r sample proto port path origin extra; do
   fi
   if bad=$(bad_run "$WORK/$STAMP.txt"); then note="discarded: $bad"; rps=0
   fi
+  if full=$(bench_conntrack_full); then note="discarded: conntrack table full ($full)"; rps=0
+  fi
 
   # As a percentage of REACTORS cores, not one - two pegged reactors burn 200% of a core.
   util=$(awk -v t="$((t1 - t0))" -v d="$SECONDS_" -v r="$REACTORS" \

bench/lib.sh

@@ -105,6 +105,17 @@ bench_await_listeners() {
     return 1
 }
 
+# With nf_conntrack loaded (Docker's NAT rules load it) every connection, loopback included, holds a
+# table entry for 120 s after it closes. A full table drops new SYNs without a word, so a cell that
+# opens connections faster than they expire stalls and reads as a slow server. Prints "count/max".
+bench_conntrack_full() {
+    local dir=${1:-/proc/sys/net/netfilter} count max
+    count=$(cat "$dir/nf_conntrack_count" 2>/dev/null) || return 1
+    max=$(cat "$dir/nf_conntrack_max" 2>/dev/null) || return 1
+    [ "$count" -ge $((max * 95 / 100)) ] || return 1
+    echo "$count/$max"
+}
+
 # A sample's apphost is named after its project; a renamed sample leaves the old one in bin/.
 bench_binary() {
     local dir=Playground/$1 proj name