Difference between revisions of "Connection Tracking System"
Jump to navigation
Jump to search
(Brief summary of using nftables and conntrack together, and short list of conntrack refs.) |
(No difference)
|
Revision as of 01:25, 15 February 2021
nftables, like iptables before it, uses netfilter's connection tracking system (often referred to as conntrack or ct) to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create stateful firewalls and to perform network address translation (NAT). Although they are technically distinct components of netfilter, they are so often used together that it's highly relevant to collect some links to conntrack documentation here:
Reference | Description |
---|---|
Netfilter's Connection Tracking System, Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006 | conntrack design and implementation details |
conntrack-tools documentation | the conntrack command line tool lets you inspect and maintain currently tracked connections |