What it does
conntrack lists, filters, and deletes entries from the kernel’s connection tracking table. This table is used by Netfilter for stateful firewalling, NAT, and packet classification.
How it works (mechanical)
Linux tracks network flows in the conntrack table. Each entry represents
a bidirectional connection (or pseudo-connection for UDP/ICMP) with state, timeouts,
and NAT mappings. conntrack queries and modifies this table via Netlink.
- Kernel subsystem: nf_conntrack
- Flow state: NEW, ESTABLISHED, RELATED
- Used by iptables/nftables for stateful rules
- Critical for NAT correctness
10 Practical Examples
# 1) List all tracked connections sudo conntrack -L
# 2) Show only TCP connections sudo conntrack -L -p tcp
# 3) Show connections for a specific source IP sudo conntrack -L -s 192.168.1.50
# 4) Show connections for a destination port sudo conntrack -L -p tcp --dport 443
# 5) Delete all connections from an IP (force reconnect) sudo conntrack -D -s 192.168.1.50
# 6) Delete a specific TCP flow sudo conntrack -D -p tcp -s 10.0.0.5 --sport 51544 -d 93.184.216.34 --dport 443
# 7) Monitor connection events in real time sudo conntrack -E
# 8) Show summary statistics sudo conntrack -S
# 9) Flush entire conntrack table (disruptive) sudo conntrack -F
# 10) Debug NAT issues (compare before/after delete) sudo conntrack -L | grep 192.168.1.50
Notes & Gotchas
- Requires root privileges.
- Deleting entries immediately breaks active connections.
- Large tables can impact performance; watch limits.
- UDP/ICMP “connections” are timeout-based, not true sessions.
- Prefer targeted deletes over full flushes.
Historical Context
Connection tracking was introduced to enable stateful firewalls and NAT on Linux.
The conntrack userspace tool replaced older /proc-based inspection and
became essential for diagnosing complex firewall behavior.
Modern Equivalent / Related Tools
- nft — modern firewall framework (replaces iptables)
- iptables -L -v — rule counters and state matches
- ss — socket-level view (process perspective)
- tcpdump — packet-level truth
- sysctl net.netfilter.* — conntrack tuning