conntrack
also: connection tracking, nf_conntrack, ct
A kernel subsystem that tracks the state of network connections, maintaining a table of active TCP, UDP, and other protocol connections to enable stateful packet filtering.
Conntrack (connection tracking) is a Linux kernel module that monitors and records information about network connections passing through the system. It maintains a dynamic table of connection states, allowing the firewall to make intelligent filtering decisions based on whether packets belong to established, new, or related connections.
For example, when a client initiates an outbound TCP connection to a web server, conntrack records this as a NEW connection. When the server responds, conntrack recognizes the return traffic as belonging to an ESTABLISHED connection and allows it through, even if the firewall would normally block unsolicited inbound traffic.
Conntrack is essential for stateful firewalling with tools like iptables and nftables. You can view active connections with cat /proc/net/nf_conntrack or the conntrack command-line tool. High-traffic systems may need to tune the conntrack table size with parameters like nf_conntrack_max to prevent connection tracking failures.