path: root/extensions/
diff options
authorJan Engelhardt <>2008-01-20 13:34:07 +0000
committerPatrick McHardy <>2008-01-20 13:34:07 +0000
commita80b6046fa216c26dbc18d587f6255afa8444885 (patch)
treeb294205d7723fd055450b42da01eaaa12baa8d2e /extensions/
parent23976ac5efe5d45d78ee6f05e487a1b9feb46655 (diff)
libxt_conntrack r0
Move libipt_conntrack to libxt_conntrack. Signed-off-by: Jan Engelhardt <>
Diffstat (limited to 'extensions/')
1 files changed, 71 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..b852bca9
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,71 @@
+This module, when combined with connection tracking, allows access to the
+connection tracking state for this packet/connection.
+[\fB!\fR] \fB--ctstate\fR \fIstatelist\fR
+\fIstatelist\fR is a comma separated list of the connection states to match.
+Possible states are listed below.
+[\fB!\fR] \fB--ctproto\fR \fIl4proto\fR
+Layer-4 protocol to match (by number or name)
+[\fB!\fR] \fB--ctorigsrc\fR \fIaddress\fR[\fB/\fR\fImask\fR]
+Match against original source address
+[\fB!\fR] \fB--ctorigdst\fR \fIaddress\fR[\fB/\fR\fImask\fR]
+Match against original destination address
+[\fB!\fR] \fB--ctreplsrc\fR \fIaddress\fR[\fB/\fR\fImask\fR]
+Match against reply source address
+[\fB!\fR] \fB--ctrepldst\fR \fIaddress\fR[\fB/\fR\fImask\fR]
+Match against reply destination address
+[\fB!\fR] \fB--ctstatus\fR \fIstatelist\fR
+\fIstatuslist\fR is a comma separated list of the connection statuses to match.
+Possible statuses are listed below.
+[\fB!\fR] \fB--ctexpire\fR \fItime\fR[\fB:\fR\fItime\fR]
+Match remaining lifetime in seconds against given value or range of values
+States for \fB--ctstate\fR:
+meaning that the packet is associated with no known connection
+meaning that the packet has started a new connection, or otherwise associated
+with a connection which has not seen packets in both directions, and
+meaning that the packet is associated with a connection which has seen packets
+in both directions,
+meaning that the packet is starting a new connection, but is associated with an
+existing connection, such as an FTP data transfer, or an ICMP error.
+A virtual state, matching if the original source address differs from the reply
+A virtual state, matching if the original destination differs from the reply
+Statuses for \fB--ctstatus\fR:
+None of the below.
+This is an expected connection (i.e. a conntrack helper set it up)
+Conntrack has seen packets in both directions.
+Conntrack entry should never be early-expired.
+Connection is confirmed: originating packet has left box.