What it does
conntrack displays, queries, and modifies entries in the Linux kernel’s connection tracking table. This table is used by Netfilter to implement stateful firewalls, NAT, and connection-aware packet handling.
How it works (mechanical)
The kernel tracks network flows as stateful objects (connections). Each
entry records protocol, source/destination, ports, state, and timeout.
conntrack communicates with the kernel via netlink to inspect
or alter this state.
- Tracks TCP, UDP, ICMP, and related protocols
- Associates packets with connection state
- Enables NAT and firewall state matching
- Automatically expires idle connections
10 Practical Examples
# 1) List all tracked connections sudo conntrack -L
# 2) Show only TCP connections sudo conntrack -L -p tcp
# 3) Filter by source IP sudo conntrack -L --src 192.168.1.10
# 4) Filter by destination port sudo conntrack -L -p tcp --dport 443
# 5) Show connection states
sudo conntrack -L | awk '{print $4}' | sort | uniq -c# 6) Delete a specific connection sudo conntrack -D -p tcp --src 10.0.0.5 --dport 22
# 7) Flush all tracked connections (dangerous) sudo conntrack -F
# 8) Monitor new connections live sudo conntrack -E
# 9) Check conntrack table usage cat /proc/sys/net/netfilter/nf_conntrack_count cat /proc/sys/net/netfilter/nf_conntrack_max
# 10) Clear stuck NAT entries sudo conntrack -D -p udp
Notes & Gotchas
- Requires root privileges.
- Flushing conntrack can break active connections.
- Large systems may need increased conntrack limits.
- Heavy NAT usage can exhaust the table.
- Closely tied to iptables/nftables behavior.
Historical Context
Connection tracking emerged with Netfilter to enable stateful firewalls and NAT on Linux. Prior firewalls were stateless, requiring explicit rules for return traffic.
Modern Equivalent / Related Tools
- nftables — modern firewall framework
- iptables — legacy Netfilter interface
- ss — socket state inspection
- tcpdump — packet-level analysis
- nf_conntrack kernel module