conntrack(8)
NAME
conntrack - command line interface for netfilter connection tracking
SYNOPSIS
conntrack -L [table] [options] [-z] conntrack -G [table] parameters conntrack -D [table] parameters conntrack -I [table] parameters conntrack -U [table] parameters conntrack -E [table] [options] conntrack -F [table] conntrack -C [table] conntrack -S
DESCRIPTION
conntrack provides a full featured userspace interface to the netfilter connection tracking system that is intended to replace the old /proc/net/ip_conntrack interface. This tool can be used to search, list, inspect and maintain the connection tracking subsystem of the Linux kernel. Using conntrack , you can dump a list of all (or a filtered selection of) currently tracked connections, delete connections from the state table, and even add new ones. In addition, you can also monitor connection tracking events, e.g. show an event message (one line) per newly established connection.
TABLES
The connection tracking subsystem maintains two internal tables:
conntrack:
This is the default table. It contains a list of all currently
tracked connections through the system. If you don't use
connection tracking exemptions (NOTRACK iptables target), this
means all connections that go through the system.
expect:
This is the table of expectations. Connection tracking
expectations are the mechanism used to "expect" RELATED
connections to existing ones. Expectations are generally used
by "connection tracking helpers" (sometimes called application
level gateways [ALGs]) for more complex protocols such as FTP,
SIP, H.323.
OPTIONS
The options recognized by conntrack can be divided into several
different groups.
COMMANDS
These options specify the particular operation to perform. Only one of
them can be specified at any given time.
-L --dump
List connection tracking or expectation table
-G, --get
Search for and show a particular (matching) entry in the given
table.
-D, --delete
Delete an entry from the given table.
-I, --create
Create a new entry from the given table.
-U, --update
Update an entry from the given table.
-E, --event
Display a real-time event log.
-F, --flush
Flush the whole given table
-C, --count
Show the table counter.
-S, --stats
Show the in-kernel connection tracking system statistics.
PARAMETERS
-z, --zero
Atomically zero counters after reading them. This option is
only valid in combination with the "-L, --dump" command options.
-o, --output [extended,xml,timestamp,id,ktimestamp,labels]
Display output in a certain format. With the extended output
option, this tool displays the layer 3 information. With
ktimestamp, it displays the in-kernel timestamp available since
2.6.38 (you can enable it via echo 1 >
/proc/sys/net/netfilter/nf_conntrack_timestamp). The labels
output option tells conntrack to show the names of connection
tracking labels that might be present.
-e, --event-mask [ALL|NEW|UPDATES|DESTROY][,...]
Set the bitmask of events that are to be generated by the in-
kernel ctnetlink event code. Using this parameter, you can
reduce the event messages generated by the kernel to those types
to those that you are actually interested in. This option can
only be used in conjunction with "-E, --event".
-b, --buffer-size value (in bytes)
Set the Netlink socket buffer size. This option is useful if the
command line tool reports ENOBUFS errors. If you do not pass
this option, the default value available at
/proc/sys/net/core/rmem_default is used. The tool reports this
problem if your process is too slow to handle all the event
messages or, in other words, if the amount of events are big
enough to overrun the socket buffer. Note that using a big
buffer reduces the chances to hit ENOBUFS, however, this results
in more memory consumption. This option can only be used in
conjunction with "-E, --event".
FILTER PARAMETERS
-s, --orig-src IP_ADDRESS
Match only entries whose source address in the original
direction equals the one specified as argument.
-d, --orig-dst IP_ADDRESS
Match only entries whose destination address in the original
direction equals the one specified as argument.
-r, --reply-src IP_ADDRESS
Match only entries whose source address in the reply direction
equals the one specified as argument.
-q, --reply-dst IP_ADDRESS
Match only entries whose destination address in the reply
direction equals the one specified as argument.
-p, --proto PROTO
Specify layer four (TCP, UDP, ...) protocol.
-f, --family PROTO
Specify layer three (ipv4, ipv6) protocol This option is only
required in conjunction with "-L, --dump". If this option is not
passed, the default layer 3 protocol will be IPv4.
-t, --timeout TIMEOUT
Specify the timeout.
-m, --mark MARK[/MASK]
Specify the conntrack mark. Optionally, a mask value can be
specified. In "--update" mode, this mask specifies the bits
that should be zeroed before XORing the MARK value into the
ctmark. Otherwise, the mask is logically ANDed with the
existing mark before the comparision. In "--create" mode, the
mask is ignored.
-l, --label LABEL
Specify a conntrack label. This option is only available in
conjunction with "-L, --dump", "-E, --event", or "-U --update".
Match entries whose labels match at least those specified. Use
multiple -l commands to specify multiple labels that need to be
set. Match entries whose labels matches at least those
specified as arguments. --label-add LABEL Specify the conntrack
label to add to to the selected conntracks. This option is only
available in conjunction with "-I, --create" or "-U, --update".
--label-del [LABEL] Specify the conntrack label to delete from
the selected conntracks. If no label is given, all labels are
deleted. This option is only available in conjunction with "-U,
--update".
-c, --secmark SECMARK
Specify the conntrack selinux security mark.
-u, --status [ASSURED|SEEN_REPLY|FIXED_TIMEOUT|EXPECTED|UNSET][,...]
Specify the conntrack status.
-n, --src-nat
Filter source NAT connections.
-g, --dst-nat
Filter destination NAT connections.
-j, --any-nat
Filter any NAT connections.
-w, --zone
Filter by conntrack zone. See iptables CT target for more
information.
--tuple-src IP_ADDRESS
Specify the tuple source address of an expectation.
--tuple-dst IP_ADDRESS
Specify the tuple destination address of an expectation.
--mask-src IP_ADDRESS
Specify the source address mask of an expectation.
--mask-dst IP_ADDRESS
Specify the destination address mask of an expectation.
PROTOCOL FILTER PARAMETERS
TCP-specific fields:
--sport, --orig-port-src PORT
Source port in original direction
--dport, --orig-port-dst PORT
Destination port in original direction
--reply-port-src PORT
Source port in reply direction
--reply-port-dst PORT
Destination port in reply direction
--state [NONE | SYN_SENT | SYN_RECV | ESTABLISHED | FIN_WAIT |
CLOSE_WAIT | LAST_ACK | TIME_WAIT | CLOSE | LISTEN]
TCP state
UDP-specific fields:
--sport, --orig-port-src PORT
Source port in original direction
--dport, --orig-port-dst PORT
Destination port in original direction
--reply-port-src PORT
Source port in reply direction
--reply-port-dst PORT
Destination port in reply direction
ICMP-specific fields:
--icmp-type TYPE
ICMP Type. Has to be specified numerically.
--icmp-code CODE
ICMP Code. Has to be specified numerically.
--icmp-id ID
ICMP Id. Has to be specified numerically (non-mandatory)
UDPlite-specific fields:
--sport, --orig-port-src PORT
Source port in original direction
--dport, --orig-port-dst PORT
Destination port in original direction
--reply-port-src PORT
Source port in reply direction
--reply-port-dst PORT
Destination port in reply direction
SCTP-specific fields:
--sport, --orig-port-src PORT
Source port in original direction
--dport, --orig-port-dst PORT
Destination port in original direction
--reply-port-src PORT
Source port in reply direction
--reply-port-dst PORT
Destination port in reply direction
--state [NONE | CLOSED | COOKIE_WAIT | COOKIE_ECHOED | ESTABLISHED |
SHUTDOWN_SENT | SHUTDOWN_RECD | SHUTDOWN_ACK_SENT]
SCTP state
--orig-vtag value
Verification tag (32-bits value) in the original direction
--reply-vtag value
Verification tag (32-bits value) in the reply direction
DCCP-specific fields (needs Linux >= 2.6.30):
--sport, --orig-port-src PORT
Source port in original direction
--dport, --orig-port-dst PORT
Destination port in original direction
--reply-port-src PORT
Source port in reply direction
--reply-port-dst PORT
Destination port in reply direction
--state [NONE | REQUEST | RESPOND | PARTOPEN | OPEN | CLOSEREQ |
CLOSING | TIMEWAIT]
DCCP state --role [client | server] Role that the original
conntrack tuple is tracking
GRE-specific fields:
--srckey, --orig-key-src KEY
Source key in original direction (in hexadecimal or decimal)
--dstkey, --orig-key-dst KEY
Destination key in original direction (in hexadecimal or
decimal)
--reply-key-src KEY
Source key in reply direction (in hexadecimal or decimal)
--reply-key-dst KEY
Destination key in reply direction (in hexadecimal or decimal)
DIAGNOSTICS
The exit code is 0 for correct function. Errors which appear to
be caused by invalid command line parameters cause an exit code
of 2. Any other errors cause an exit code of 1.
EXAMPLES
conntrack -L
Show the connection tracking table in /proc/net/ip_conntrack
format
conntrack -L -o extended
Show the connection tracking table in /proc/net/nf_conntrack
format
conntrack -L -o xml
Show the connection tracking table in XML
conntrack -L -f ipv6 -o extended
Only dump IPv6 connections in /proc/net/nf_conntrack format
conntrack -L --src-nat
Show source NAT connections
conntrack -E -o timestamp
Show connection events together with the timestamp
conntrack -D -s 1.2.3.4
Delete all flow whose source address is 1.2.3.4
conntrack -U -s 1.2.3.4 -m 1
Set connmark to 1 of all the flows whose source address is
1.2.3.4
BUGS
Please, report them to [email protected] or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org).
SEE ALSO
iptables(8) See http://conntrack-tools.netfilter.org
AUTHORS
Jay Schulist, Patrick McHardy, Harald Welte and Pablo Neira Ayuso wrote the kernel-level "ctnetlink" interface that is used by the conntrack tool. Pablo Neira Ayuso wrote and maintain the conntrack tool, Harald Welte added support for conntrack based accounting counters. Man page written by Harald Welte <[email protected]> and Pablo Neira Ayuso <[email protected]>. Sep 25, 2014 CONNTRACK(8)
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
