conntrack(8)
conntrack is a userspace tool for querying and managing netfilter connection tracking state.
Synopsis
conntrack [options] [commands]Description
conntrack provides userspace access to the netfilter connection tracking subsystem, allowing you to query, update, and delete connection tracking entries. It is essential for managing stateful firewall rules, NAT operations, and network debugging on Linux systems using netfilter/iptables.
The tool can display active connections, show statistics, configure timeout values, and manage conntrack events in real-time. It's commonly used for network troubleshooting, monitoring active connections, and tuning firewall behavior.
Common options
| Flag | What it does |
|---|---|
-L, --dump | List all tracked connections in the conntrack table |
-E, --event | Show conntrack events in real-time (new, update, destroy) |
-S, --stats | Show conntrack statistics and memory usage information |
-D, --delete | Delete connections matching specified criteria |
-U, --update | Update properties of an existing conntrack entry |
-I, --create | Create a new conntrack entry manually |
-p, --protonum | Filter by protocol (tcp, udp, icmp, etc.) |
-s, --src | Filter by source IP address |
-d, --dst | Filter by destination IP address |
--sport | Filter by source port number |
--dport | Filter by destination port number |
-o, --output | Select output format (xml, extended, compact) |
Examples
List all active connections currently tracked by netfilter
conntrack -LList only TCP connections in the conntrack table
conntrack -L -p tcpShow all connections originating from 192.168.1.100
conntrack -L -s 192.168.1.100Monitor conntrack events in real-time as connections are created and destroyed
conntrack -EDisplay overall conntrack statistics including number of entries and memory usage
conntrack -SDelete all tracked TCP connections using destination port 22 (SSH)
conntrack -D -p tcp --dport 22List only established TCP connections
conntrack -L -p tcp --state ESTABLISHEDDisplay connections in extended format with additional details
conntrack -L -o extended