Provided by: conntrack_1.4.5-2_amd64 bug

NAME

       conntrack - command line interface for netfilter connection tracking

SYNOPSIS

       conntrack -L [table] [options] [-z]
       conntrack -G [table] parameters
       conntrack -D [table] parameters
       conntrack -I [table] parameters
       conntrack -U [table] parameters
       conntrack -E [table] [options]
       conntrack -F [table]
       conntrack -C [table]
       conntrack -S

DESCRIPTION

       The  conntrack  utilty  provides a full featured userspace interface to the Netfilter connection tracking
       system that is intended to replace the old /proc/net/ip_conntrack interface. This tool  can  be  used  to
       search, list, inspect and maintain the connection tracking subsystem of the Linux kernel.

       Using  conntrack,  you can dump a list of all (or a filtered selection of) currently tracked connections,
       delete connections from the state table, and even add new ones.

       In addition, you can also monitor connection tracking events, e.g. show an event message (one  line)  per
       newly established connection.

TABLES

       The connection tracking subsystem maintains several internal tables:

       conntrack:
              This  is  the  default table.  It contains a list of all currently tracked connections through the
              system.  If you don't use connection tracking exemptions (NOTRACK iptables target), this means all
              connections that go through the system.

       expect:
              This  is  the  table  of expectations.  Connection tracking expectations are the mechanism used to
              "expect" RELATED connections to existing ones.  Expectations are  generally  used  by  "connection
              tracking  helpers" (sometimes called application level gateways [ALGs]) for more complex protocols
              such as FTP, SIP or H.323.

       dying: This table shows the conntrack entries, that have expired and that  have  been  destroyed  by  the
              connection tracking system itself, or via the conntrack utility.

       unconfirmed:
              This  table  shows  new entries, that are not yet inserted into the conntrack table. These entries
              are attached to packets that are traversing the stack, but did not reach the confirmation point at
              the postrouting hook.

              The  tables  "dying"  and  "unconfirmed"  are  basically only useful for debugging purposes. Under
              normal operation, it is hard to see entries in any of them.  There are corner cases, where  it  is
              valid to see entries in the unconfirmed table, eg. when packets that are enqueued via nfqueue, and
              the dying table, eg. when conntrackd(8) runs in event reliable mode.

OPTIONS

       The options recognized by conntrack can be divided into several different groups.

   COMMANDS
       These options specify the particular operation to perform.  Only one of them  can  be  specified  at  any
       given time.

       -L --dump
              List connection tracking or expectation table

       -G, --get
              Search for and show a particular (matching) entry in the given table.

       -D, --delete
              Delete an entry from the given table.

       -I, --create
              Create a new entry from the given table.

       -U, --update
              Update an entry from the given table.

       -E, --event
              Display a real-time event log.

       -F, --flush
              Flush the whole given table

       -C, --count
              Show the table counter.

       -S, --stats
              Show the in-kernel connection tracking system statistics.

   PARAMETERS
       -z, --zero
              Atomically  zero  counters  after reading them.  This option is only valid in combination with the
              "-L, --dump" command options.

       -o, --output [extended,xml,timestamp,id,ktimestamp,labels]
              Display output in a certain format. With the extended output option, this tool displays the  layer
              3  information.  With  ktimestamp, it displays the in-kernel timestamp available since 2.6.38 (you
              can enable it via the sysctl(8)  key  net.netfilter.nf_conntrack_timestamp).   The  labels  output
              option tells conntrack to show the names of connection tracking labels that might be present.

       -e, --event-mask [ALL|NEW|UPDATES|DESTROY][,...]
              Set  the  bitmask of events that are to be generated by the in-kernel ctnetlink event code.  Using
              this parameter, you can reduce the event messages generated by the kernel to those types to  those
              that  you  are  actually  interested  in.   This  option can only be used in conjunction with "-E,
              --event".

       -b, --buffer-size value
              Set the Netlink socket buffer size in bytes. This option  is  useful  if  the  command  line  tool
              reports  ENOBUFS  errors. If you do not pass this option, the default value available at sysctl(8)
              key net.core.rmem_default is used. The tool reports this problem if your process is  too  slow  to
              handle  all  the  event  messages  or,  in  other words, if the amount of events are big enough to
              overrun the socket buffer. Note that using a big  buffer  reduces  the  chances  to  hit  ENOBUFS,
              however,  this  results  in  more memory consumption.  This option can only be used in conjunction
              with "-E, --event".

   FILTER PARAMETERS
       -s, --src, --orig-src IP_ADDRESS
              Match only entries whose source address in the original direction  equals  the  one  specified  as
              argument. Implies "--mask-src" when CIDR notation is used.

       -d, --dst, --orig-dst IP_ADDRESS
              Match only entries whose destination address in the original direction equals the one specified as
              argument. Implies "--mask-dst" when CIDR notation is used.

       -r, --reply-src IP_ADDRESS
              Match only entries whose source address in  the  reply  direction  equals  the  one  specified  as
              argument.

       -q, --reply-dst IP_ADDRESS
              Match  only  entries  whose destination address in the reply direction equals the one specified as
              argument.

       -p, --proto PROTO
              Specify layer four (TCP, UDP, ...) protocol.

       -f, --family PROTO
              Specify layer three (ipv4, ipv6) protocol This option is only required in  conjunction  with  "-L,
              --dump". If this option is not passed, the default layer 3 protocol will be IPv4.

       -t, --timeout TIMEOUT
              Specify the timeout.

       -m, --mark MARK[/MASK]
              Specify  the conntrack mark.  Optionally, a mask value can be specified.  In "--update" mode, this
              mask specifies the bits that should be zeroed before  XORing  the  MARK  value  into  the  ctmark.
              Otherwise,  the  mask  is  logically  ANDed  with  the  existing  mark  before the comparision. In
              "--create" mode, the mask is ignored.

       -l, --label LABEL
              Specify a conntrack label.  This option is only available in conjunction with "-L,  --dump",  "-E,
              --event",  "-U  --update"  or  "-D  --delete".   Match  entries  whose labels match at least those
              specified.  Use multiple -l commands to specify multiple  labels  that  need  to  be  set.   Match
              entries whose labels matches at least those specified as arguments.

       --label-add LABEL
              Specify  the  conntrack label to add to to the selected conntracks.  This option is only available
              in conjunction with "-I, --create" or "-U, --update".

       --label-del [LABEL]
              Specify the conntrack label to delete from the selected conntracks.  If no  label  is  given,  all
              labels are deleted.  This option is only available in conjunction with "-U, --update".

       -c, --secmark SECMARK
              Specify the conntrack selinux security mark.

       -u, --status [ASSURED|SEEN_REPLY|FIXED_TIMEOUT|EXPECTED|UNSET][,...]
              Specify the conntrack status.

       -n, --src-nat
              Filter source NAT connections.

       -g, --dst-nat
              Filter destination NAT connections.

       -j, --any-nat
              Filter any NAT connections.

       -w, --zone
              Filter by conntrack zone. See iptables CT target for more information.

       --orig-zone
              Filter by conntrack zone in original direction.  See iptables CT target for more information.

       --reply-zone
              Filter by conntrack zone in reply direction.  See iptables CT target for more information.

       --tuple-src IP_ADDRESS
              Specify  the  tuple  source address of an expectation.  Implies "--mask-src" when CIDR notation is
              used.

       --tuple-dst IP_ADDRESS
              Specify the tuple destination address of an expectation.  Implies "--mask-dst" when CIDR  notation
              is used.

       --mask-src IP_ADDRESS
              Specify the source address mask.  For conntracks this option is only available in conjunction with
              "-L, --dump", "-E, --event", "-U --update" or "-D --delete".  For expectations this option is only
              available in conjunction with "-I, --create".

       --mask-dst IP_ADDRESS
              Specify the destination address mask.  Same limitations as for "--mask-src".

   PROTOCOL FILTER PARAMETERS
       TCP-specific fields:

       --sport, --orig-port-src PORT
              Source port in original direction

       --dport, --orig-port-dst PORT
              Destination port in original direction

       --reply-port-src PORT
              Source port in reply direction

       --reply-port-dst PORT
              Destination port in reply direction

       --state state
              TCP  state,  one  of  NONE,  SYN_SENT,  SYN_RECV,  ESTABLISHED,  FIN_WAIT,  CLOSE_WAIT,  LAST_ACK,
              TIME_WAIT, CLOSE or LISTEN.

       UDP-specific fields:

       --sport, --orig-port-src PORT
              Source port in original direction

       --dport, --orig-port-dst PORT
              Destination port in original direction

       --reply-port-src PORT
              Source port in reply direction

       --reply-port-dst PORT
              Destination port in reply direction

       ICMP-specific fields:

       --icmp-type TYPE
              ICMP Type. Has to be specified numerically.

       --icmp-code CODE
              ICMP Code. Has to be specified numerically.

       --icmp-id ID
              ICMP Id. Has to be specified numerically (non-mandatory)

       UDPlite-specific fields:

       --sport, --orig-port-src PORT
              Source port in original direction

       --dport, --orig-port-dst PORT
              Destination port in original direction

       --reply-port-src PORT
              Source port in reply direction

       --reply-port-dst PORT
              Destination port in reply direction

       SCTP-specific fields:

       --sport, --orig-port-src PORT
              Source port in original direction

       --dport, --orig-port-dst PORT
              Destination port in original direction

       --reply-port-src PORT
              Source port in reply direction

       --reply-port-dst PORT
              Destination port in reply direction

       --state state
              SCTP  state,  one  of  NONE,  CLOSED,  COOKIE_WAIT,  COOKIE_ECHOED,  ESTABLISHED,   SHUTDOWN_SENT,
              SHUTDOWN_RECD, SHUTDOWN_ACK_SENT.

       --orig-vtag value
              Verification tag (32-bits value) in the original direction

       --reply-vtag value
              Verification tag (32-bits value) in the reply direction

       DCCP-specific fields (needs Linux >= 2.6.30):

       --sport, --orig-port-src PORT
              Source port in original direction

       --dport, --orig-port-dst PORT
              Destination port in original direction

       --reply-port-src PORT
              Source port in reply direction

       --reply-port-dst PORT
              Destination port in reply direction

       --state state
              DCCP state, one of NONE, REQUEST, RESPOND, PARTOPEN, OPEN, CLOSEREQ, CLOSING, TIMEWAIT.

       --role [client|server]
              Role that the original conntrack tuple is tracking

       GRE-specific fields:

       --srckey, --orig-key-src KEY
              Source key in original direction (in hexadecimal or decimal)

       --dstkey, --orig-key-dst KEY
              Destination key in original direction (in hexadecimal or decimal)

       --reply-key-src KEY
              Source key in reply direction (in hexadecimal or decimal)

       --reply-key-dst KEY
              Destination key in reply direction (in hexadecimal or decimal)

DIAGNOSTICS

       The  exit  code  is  0  for  correct  function.  Errors which appear to be caused by invalid command line
       parameters cause an exit code of 2.  Any other errors cause an exit code of 1.

EXAMPLES

       conntrack -L
              Show the connection tracking table in /proc/net/ip_conntrack format

       conntrack -L -o extended
              Show the connection tracking table in /proc/net/nf_conntrack format, with additional information.

       conntrack -L -o xml
              Show the connection tracking table in XML

       conntrack -L -f ipv6 -o extended
              Only dump IPv6 connections in /proc/net/nf_conntrack format, with additional information.

       conntrack -L --src-nat
              Show source NAT connections

       conntrack -E -o timestamp
              Show connection events together with the timestamp

       conntrack -D -s 1.2.3.4
              Delete all flow whose source address is 1.2.3.4

       conntrack -U -s 1.2.3.4 -m 1
              Set connmark to 1 of all the flows whose source address is 1.2.3.4

BUGS

       Please,  report  them  to  netfilter-devel@vger.kernel.org  or  file  a  bug  in   Netfilter's   bugzilla
       (https://bugzilla.netfilter.org).

SEE ALSO

       nftables(8),iptables(8),conntrackd(8)
       See http://conntrack-tools.netfilter.org

AUTHORS

       Jay  Schulist,  Patrick  McHardy,  Harald  Welte and Pablo Neira Ayuso wrote the kernel-level "ctnetlink"
       interface that is used by the conntrack tool.

       Pablo Neira Ayuso wrote and maintain the conntrack tool, Harald Welte added support for  conntrack  based
       accounting counters.

       Man page written by Harald Welte <laforge@netfilter.org> and Pablo Neira Ayuso <pablo@netfilter.org>.

                                                  Sep 26, 2017                                      CONNTRACK(8)