diff options
authorJan Engelhardt <>2012-09-28 10:52:32 +0200
committerJan Engelhardt <>2012-09-30 11:32:49 +0200
commitfaeaf11536f605ebb733d4d5f5ec2ca074d3f247 (patch)
parent4496801821c01e3934996b40e0012ddcb969a8df (diff)
doc: trim "state" manpage and reference conntrack instead
The module is practically obsolete, so just pinpoint to the replacement in short order. Signed-off-by: Jan Engelhardt <>
2 files changed, 7 insertions, 23 deletions
diff --git a/extensions/ b/extensions/
index 0b418842..e7b5426d 100644
--- a/extensions/
+++ b/extensions/
@@ -52,7 +52,7 @@ A 32 bit random custom value to feed hash calculation.
-iptables \-t mangle \-A PREROUTING \-m state \-\-state NEW
+iptables \-t mangle \-A PREROUTING \-m conntrack \-\-ctstate NEW
\-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000
\-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe
diff --git a/extensions/ b/extensions/
index 37d095bc..bd60468f 100644
--- a/extensions/
+++ b/extensions/
@@ -1,24 +1,8 @@
-This module, when combined with connection tracking, allows access to
-the connection tracking state for this packet.
+The "state" module is an obsolete version of "conntrack".
+"state" allows access to the connection tracking state for this packet.
[\fB!\fP] \fB\-\-state\fP \fIstate\fP
-Where state is a comma separated list of the connection states to
-match. Possible states are
-meaning that the packet could not be identified for some reason which
-includes running out of memory and ICMP errors which don't correspond to any
-known connection,
-meaning that the packet is associated with a connection which has seen
-packets in both directions,
-meaning that the packet has started a new connection, or otherwise
-associated with a connection which has not seen packets in both
-directions, and
-meaning that the packet is starting a new connection, but is
-associated with an existing connection, such as an FTP data transfer,
-or an ICMP error.
-meaning that the packet is not tracked at all, which happens if you use
-the NOTRACK target in raw table.
+Where state is a comma separated list of the connection states to match. Only a
+subset of the states unterstood by "conntrack" are recognized: \fBINVALID\fP,
+description, see the "conntrack" heading in this manpage.