conntrack

Each entry holds a flow twice: as it left and as its replies must look, with the NAT's rewrites in the second half, its state ([UNREPLIED], [ASSURED]) and the seconds before it is forgotten. A packet matching the reply half is let in and translated back. Deleting entries makes the next packet start afresh, under the current rules.

conntrack command usage

conntrack -L [filters]
conntrack -D [filters]

Options

-L

list entries

-D

delete the matching entries

-p udp

only one protocol

-s / -d ADDRESS

by the original source or destination

--orig-port-dst PORT

by the original destination port

--orig-port-src PORT

by the original source port

-F

forget every entry

-E

print events as entries come and go

conntrack examples

conntrack -L -p udp

Lists the UDP flows the router tracks, with their NAT mappings and timers.

conntrack -L -p tcp

Lists the TCP connections, each with its four addresses: as sent, and as the reply must look.

conntrack -D -p udp -s 10.0.2.10

Forgets one device's UDP flows, so its next packets are mapped under the current rules.

cat /proc/net/nf_conntrack

The same table without the tool.

Pitfalls

• Changing a NAT or firewall rule does not change flows already tracked: they keep the old mapping until they time out or are deleted.

Run it on real machines