View and manage netfilter connection tracking table.
medium risk
conntrack tools interact with the netfilter connection tracking subsystem — the table that tracks established connections for stateful firewalling. Used to monitor active connections, debug firewall issues, and force-expire stuck connection entries.
| Flag | Meaning |
|---|---|
-L --dump | List all tracked connections |
-D --delete | Delete matching connections |
-E --event | Stream connection events in real time |
-s --source | Filter by source address |
conntrack -L | wc -lCount current tracked connections · explain & risk-check →conntrack -L | grep 10.0.0.5Show connections from/to specific IP · explain & risk-check →conntrack -EStream real-time connection events · explain & risk-check →conntrack -D -s 10.0.0.5Drop all tracked connections from an IP · explain & risk-check →cat /proc/sys/net/netfilter/nf_conntrack_countCurrent connection count vs maximum · explain & risk-check →Watch `cat /proc/sys/net/netfilter/nf_conntrack_count` vs `nf_conntrack_max` — when count approaches max, new connections are silently dropped. Increase `sysctl net.netfilter.nf_conntrack_max` to fix.
Reference text is hand-written and may be incomplete — check man conntrack for your version. Test destructive commands on a non-production system first.