.TH CONNTRACK 8 "Jul 5, 2010" "" "" .\" Man page written by Harald Welte /proc/sys/net/netfilter/nf_conntrack_timestamp). The labels output option tells conntrack to show the names of connection tracking labels that might be present. .TP .BI "-e, --event-mask " "[ALL|NEW|UPDATES|DESTROY][,...]" Set the bitmask of events that are to be generated by the in-kernel ctnetlink event code. Using this parameter, you can reduce the event messages generated by the kernel to those types to those that you are actually interested in. . This option can only be used in conjunction with "-E, --event". .TP .BI "-b, --buffer-size " "value (in bytes)" Set the Netlink socket buffer size. This option is useful if the command line tool reports ENOBUFS errors. If you do not pass this option, the default value available at /proc/sys/net/core/rmem_default is used. The tool reports this problem if your process is too slow to handle all the event messages or, in other words, if the amount of events are big enough to overrun the socket buffer. Note that using a big buffer reduces the chances to hit ENOBUFS, however, this results in more memory consumption. . This option can only be used in conjunction with "-E, --event". .SS FILTER PARAMETERS .TP .BI "-s, --orig-src " IP_ADDRESS Match only entries whose source address in the original direction equals the one specified as argument. .TP .BI "-d, --orig-dst " IP_ADDRESS Match only entries whose destination address in the original direction equals the one specified as argument. .TP .BI "-r, --reply-src " IP_ADDRESS Match only entries whose source address in the reply direction equals the one specified as argument. .TP .BI "-q, --reply-dst " IP_ADDRESS Match only entries whose destination address in the reply direction equals the one specified as argument. .TP .BI "-p, --proto " "PROTO " Specify layer four (TCP, UDP, ...) protocol. .TP .BI "-f, --family " "PROTO" Specify layer three (ipv4, ipv6) protocol This option is only required in conjunction with "-L, --dump". If this option is not passed, the default layer 3 protocol will be IPv4. .TP .BI "-t, --timeout " "TIMEOUT" Specify the timeout. .TP .BI "-m, --mark " "MARK[/MASK]" Specify the conntrack mark. Optionally, a mask value can be specified. In "--update" mode, this mask specifies the bits that should be zeroed before XORing the MARK value into the ctmark. Otherwise, the mask is logically ANDed with the existing mark before the comparision. In "--create" mode, the mask is ignored. .TP .BI "-l, --label " "LABEL" Specify a conntrack label. This option is only available in conjunction with "-L, --dump", "-E, --event", or "-U --update". Match entries whose labels match at least those specified. Use multiple -l commands to specify multiple labels that need to be set. Match entries whose labels matches at least those specified as arguments. .BI "--label-add " "LABEL" Specify the conntrack label to add to to the selected conntracks. This option is only available in conjunction with "-I, --create" or "-U, --update". .BI "--label-del " "[LABEL]" Specify the conntrack label to delete from the selected conntracks. If no label is given, all labels are deleted. This option is only available in conjunction with "-U, --update". .TP .BI "-c, --secmark " "SECMARK" Specify the conntrack selinux security mark. .TP .BI "-u, --status " "[ASSURED|SEEN_REPLY|FIXED_TIMEOUT|EXPECTED|UNSET][,...]" Specify the conntrack status. .TP .BI "-n, --src-nat " Filter source NAT connections. .TP .BI "-g, --dst-nat " Filter destination NAT connections. .TP .BI "-j, --any-nat " Filter any NAT connections. .TP .BI "-w, --zone " Filter by conntrack zone. See iptables CT target for more information. .TP .BI "--tuple-src " IP_ADDRESS Specify the tuple source address of an expectation. .TP .BI "--tuple-dst " IP_ADDRESS Specify the tuple destination address of an expectation. .TP .BI "--mask-src " IP_ADDRESS Specify the source address mask of an expectation. .TP .BI "--mask-dst " IP_ADDRESS Specify the destination address mask of an expectation. .SS PROTOCOL FILTER PARAMETERS .TP TCP-specific fields: .TP .BI "--sport, --orig-port-src " "PORT" Source port in original direction .TP .BI "--dport, --orig-port-dst " "PORT" Destination port in original direction .TP .BI "--reply-port-src " "PORT" Source port in reply direction .TP .BI "--reply-port-dst " "PORT" Destination port in reply direction .TP .BI "--state " "[NONE | SYN_SENT | SYN_RECV | ESTABLISHED | FIN_WAIT | CLOSE_WAIT | LAST_ACK | TIME_WAIT | CLOSE | LISTEN]" TCP state .TP UDP-specific fields: .TP .BI "--sport, --orig-port-src " "PORT" Source port in original direction .TP .BI "--dport, --orig-port-dst " "PORT" Destination port in original direction .TP .BI "--reply-port-src " "PORT" Source port in reply direction .TP .BI "--reply-port-dst " "PORT" Destination port in reply direction .TP ICMP-specific fields: .TP .BI "--icmp-type " "TYPE" ICMP Type. Has to be specified numerically. .TP .BI "--icmp-code " "CODE" ICMP Code. Has to be specified numerically. .TP .BI "--icmp-id " "ID" ICMP Id. Has to be specified numerically (non-mandatory) .TP UDPlite-specific fields: .TP .BI "--sport, --orig-port-src " "PORT" Source port in original direction .TP .BI "--dport, --orig-port-dst " "PORT" Destination port in original direction .TP .BI "--reply-port-src " "PORT" Source port in reply direction .TP .BI "--reply-port-dst " "PORT" Destination port in reply direction .TP SCTP-specific fields: .TP .BI "--sport, --orig-port-src " "PORT" Source port in original direction .TP .BI "--dport, --orig-port-dst " "PORT" Destination port in original direction .TP .BI "--reply-port-src " "PORT" Source port in reply direction .TP .BI "--reply-port-dst " "PORT" Destination port in reply direction .TP .BI "--state " "[NONE | CLOSED | COOKIE_WAIT | COOKIE_ECHOED | ESTABLISHED | SHUTDOWN_SENT | SHUTDOWN_RECD | SHUTDOWN_ACK_SENT]" SCTP state .TP .BI "--orig-vtag " "value" Verification tag (32-bits value) in the original direction .TP .BI "--reply-vtag " "value" Verification tag (32-bits value) in the reply direction .TP DCCP-specific fields (needs Linux >= 2.6.30): .TP .BI "--sport, --orig-port-src " "PORT" Source port in original direction .TP .BI "--dport, --orig-port-dst " "PORT" Destination port in original direction .TP .BI "--reply-port-src " "PORT" Source port in reply direction .TP .BI "--reply-port-dst " "PORT" Destination port in reply direction .TP .BI "--state " "[NONE | REQUEST | RESPOND | PARTOPEN | OPEN | CLOSEREQ | CLOSING | TIMEWAIT]" DCCP state .BI "--role " "[client | server]" Role that the original conntrack tuple is tracking .TP GRE-specific fields: .TP .BI "--srckey, --orig-key-src " "KEY" Source key in original direction (in hexadecimal or decimal) .TP .BI "--dstkey, --orig-key-dst " "KEY" Destination key in original direction (in hexadecimal or decimal) .TP .BI "--reply-key-src " "KEY" Source key in reply direction (in hexadecimal or decimal) .TP .BI "--reply-key-dst " "KEY" Destination key in reply direction (in hexadecimal or decimal) .TP .SH DIAGNOSTICS The exit code is 0 for correct function. Errors which appear to be caused by invalid command line parameters cause an exit code of 2. Any other errors cause an exit code of 1. .SH EXAMPLES .TP .B conntrack \-L Show the connection tracking table in /proc/net/ip_conntrack format .TP .B conntrack \-L -o extended Show the connection tracking table in /proc/net/nf_conntrack format .TP .B conntrack \-L \-o xml Show the connection tracking table in XML .TP .B conntrack \-L -f ipv6 -o extended Only dump IPv6 connections in /proc/net/nf_conntrack format .TP .B conntrack \-L --src-nat Show source NAT connections .TP .B conntrack \-E \-o timestamp Show connection events together with the timestamp .TP .B conntrack \-D \-s 1.2.3.4 Delete all flow whose source address is 1.2.3.4 .TP .B conntrack \-U \-s 1.2.3.4 \-m 1 Set connmark to 1 of all the flows whose source address is 1.2.3.4 .SH BUGS Please, report them to netfilter-devel@vger.kernel.org or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org). .SH SEE ALSO .BR iptables (8) .br See .BR "http://conntrack-tools.netfilter.org" .SH AUTHORS Jay Schulist, Patrick McHardy, Harald Welte and Pablo Neira Ayuso wrote the kernel-level "ctnetlink" interface that is used by the conntrack tool. .PP Pablo Neira Ayuso wrote and maintain the conntrack tool, Harald Welte added support for conntrack based accounting counters. .PP Man page written by Harald Welte and Pablo Neira Ayuso .