CONNTRACK(8) (NAME) conntrack - netfilter (SYNOPSIS) conntrack -L [table] [options] [-z] conntrack -G [table] parameters conntrack -D [table] parameters conntrack -I [table] parameters conntrack -A [table] parameters conntrack -U [table] parameters conntrack -E [table] [options] conntrack -F [table] conntrack -C [table] conntrack -S conntrack -R file (DESCRIPTION) conntrack (userspace) Netfilter /proc/net/ip_conntrack . . conntrack ( ) . () . (TABLES) : conntrack: . . ( NOTRACK iptables) . expect: (expectations) . << >> (RELATED) . << >> ( ALG ) FTP SIP H.323 . dying: conntrack conntrack . unconfirmed: conntrack . postrouting . "dying" "unconfirmed" . . unconfirmed nfqueue dying conntrackd(8) (event reliable mode) . (OPTIONS) conntrack . (COMMANDS) . . -L --dump . -G, --get () . -D, --delete . -I, --create . -A, --add . -U, --update . -E, --event (real-time). -F, --flush . -C, --count . -S, --stats . -R, --load-file . (stdin) "-" . (PARAMETERS) -z, --zero . "-L, --dump" . -o, --output [extended,xml,save,timestamp,id,ktimestamp,labels] . extended . ktimestamp 2.6.38 ( sysctl(8) net.netfilter.nf_conntrack_timestamp ). labels conntrack . userspace . -e, --event-mask [ALL|NEW|UPDATES|DESTROY][,...] ctnetlink . . "-E, --event" . -b, --buffer-size value Netlink . ENOBUFS . sysctl(8) net.core.rmem_default . . ENOBUFS . "-E, --event" . (FILTER PARAMETERS) -s, --src, --orig-src IP_ADDRESS . CIDR "--mask-src" . -d, --dst, --orig-dst IP_ADDRESS . CIDR "--mask-dst" . -r, --reply-src IP_ADDRESS . -q, --reply-dst IP_ADDRESS . -p, --proto PROTO (TCP UDP ...). -f, --family PROTO (ipv4 ipv6). "-L, --dump" . IPv4 . -t, --timeout TIMEOUT (timeout). -m, --mark MARK[/MASK] (mark) conntrack. . "--update" XOR MARK ctmark . AND . "--create" . -l, --label LABEL (label) conntrack. "-L, --dump" "-E, --event" "-U --update" "-D --delete" . . -l . --labelmap PATH connlabel.conf . "-L, --dump" "-E, --event" "-U --update" "-D --delete" . --label-add LABEL conntrack . "-I, --create" "-A, --add" "-U, --update" . 'connlabel' iptables 'ct label' nftables ct label "-U, --update" . --label-del [LABEL] conntrack . . "-U, --update" . -c, --secmark SECMARK selinux conntrack. -u, --status [ASSURED|SEEN_REPLY|FIXED_TIMEOUT|EXPECTED|OFFLOAD|UNSET][,...] conntrack. -n, --src-nat NAT (Source NAT). -g, --dst-nat NAT (Destination NAT). -j, --any-nat NAT. -w, --zone (zone) conntrack. CT iptables . --orig-zone conntrack (). CT iptables . --reply-zone conntrack (reply). CT iptables . --tuple-src IP_ADDRESS (tuple) . CIDR "--mask-src" . --tuple-dst IP_ADDRESS (tuple) . CIDR "--mask-dst" . --mask-src IP_ADDRESS . conntrack "-L, --dump" "-E, --event" "-U --update" "-D --delete" . (expectations) "-I, --create" . --mask-dst IP_ADDRESS . "--mask-src". (PROTOCOL FILTER PARAMETERS) TCP: --sport, --orig-port-src PORT --dport, --orig-port-dst PORT --reply-port-src PORT --reply-port-dst PORT --state state TCP NONE SYN_SENT SYN_RECV ESTABLISHED FIN_WAIT CLOSE_WAIT LAST_ACK TIME_WAIT CLOSE LISTEN. UDP: --sport, --orig-port-src PORT --dport, --orig-port-dst PORT --reply-port-src PORT --reply-port-dst PORT ICMP: --icmp-type TYPE ICMP. . --icmp-code CODE ICMP. . --icmp-id ID ICMP. (). UDPlite: --sport, --orig-port-src PORT --dport, --orig-port-dst PORT --reply-port-src PORT --reply-port-dst PORT SCTP: --sport, --orig-port-src PORT --dport, --orig-port-dst PORT --reply-port-src PORT --reply-port-dst PORT --state state SCTP NONE CLOSED COOKIE_WAIT COOKIE_ECHOED ESTABLISHED SHUTDOWN_SENT SHUTDOWN_RECD SHUTDOWN_ACK_SENT. --orig-vtag value ( ) --reply-vtag value ( ) DCCP ( >= 2.6.30): --sport, --orig-port-src PORT --dport, --orig-port-dst PORT --reply-port-src PORT --reply-port-dst PORT --state state DCCP NONE REQUEST RESPOND PARTOPEN OPEN CLOSEREQ CLOSING TIMEWAIT. --role [client|server] (tuple) conntrack GRE: --srckey, --orig-key-src KEY ( ) --dstkey, --orig-key-dst KEY ( ) --reply-key-src KEY ( ) --reply-key-dst KEY ( ) (DIAGNOSTICS) 0 . 2 . 1 . (EXAMPLES) conntrack -L /proc/net/ip_conntrack conntrack -L -o extended /proc/net/nf_conntrack . conntrack -L -o xml XML conntrack -L -o save conntrack conntrack -L -f ipv6 -o extended IPv6 /proc/net/nf_conntrack . conntrack -L --src-nat NAT conntrack -E -o timestamp conntrack -D -s 1.2.3.4 1.2.3.4 conntrack -U -s 1.2.3.4 -m 1 connmark 1 1.2.3.4 conntrack -L -w 11 -o save | sed s/-w 11/-w 12/g | conntrack --load-file - 11 12 ct (BUGS) netfilter- devel@vger.kernel.org Netfilter (https://bugzilla.netfilter.org). (SEE ALSO) nftables(8), iptables(8), conntrackd(8) : http://conntrack-tools.netfilter.org (AUTHORS) (Jay Schulist) (Patrick McHardy) (Harald Welte) (Pablo Neira Ayuso) "ctnetlink" conntrack . conntrack conntrack . . 2019-08-09 CONNTRACK(8)