How to Use the Command 'conntrack' (with Examples)

The conntrack command is a powerful utility for interacting with the Netfilter connection tracking system on Linux. It allows administrators to search, list, inspect, modify, and delete connection flows. By utilizing this tool, network administrators have fine-grained control over the connections traversing a network, which is especially crucial for troubleshooting and ensuring efficient traffic flow.

Use Case 1: List All Currently Tracked Connections

Code:

conntrack --dump

Motivation:

Listing all currently tracked connections is a fundamental task for network monitoring and troubleshooting. It provides a snapshot of all active connections the system is managing, which is essential for diagnosing connection issues, ensuring that traffic is flowing as expected, and identifying potentially unauthorized or suspicious connections.

Explanation:

• conntrack: The base command used to interact with the connection tracking system.
• --dump: This option instructs conntrack to output all currently tracked connections in a human-readable format. It’s equivalent to asking the system to “dump” out its current knowledge of active connections.

Example Output:

tcp      6 431647 ESTABLISHED src=192.168.1.100 dst=192.168.1.1 sport=45678 dport=80 packets=10 bytes=5000 src=192.168.1.1 dst=192.168.1.100 sport=80 dport=45678 packets=10 bytes=6500 mark=0 use=2

This output shows a TCP connection with various details, such as source/destination IP addresses and ports, the state of the connection, and traffic statistics like packet and byte counts.

Use Case 2: Display a Real-Time Event Log of Connection Changes

Code:

conntrack --event

Motivation:

Sometimes, it is not enough to analyze static snapshots of connection states. A real-time event log enables administrators to observe changes as they happen, which is invaluable for identifying transient issues and understanding dynamic network behaviors as new connections are established or terminated.

Explanation:

• conntrack: The command for interacting with the connection tracking system.
• --event: This option configures conntrack to continuously monitor and report changes to connection states as they occur, providing real-time feedback.

Example Output:

tcp      6 20 SYN_SENT src=192.168.1.101 dst=8.8.8.8 sport=54321 dport=80 [UNREPLIED] src=8.8.8.8 dst=192.168.1.101 sport=80 dport=54321 mark=0 use=1

This entry logs an event where a TCP connection attempt has reached the SYN_SENT state, indicating that the initial connection handshake has started.

Use Case 3: Display a Real-Time Event Log of Connection Changes with Timestamps

Code:

conntrack --event -o timestamp

Motivation:

Tracking connection changes in real time is insightful, but adding timestamps to these events provides a temporal context, allowing administrators to correlate changes with other events in their network or system logs.

Explanation:

• conntrack: Core command for connection interaction.
• --event: Enables real-time logging of connection events.
• -o: Specifies the output format option.
• timestamp: Adds a timestamp to each event, giving precise time data on when changes occurred.

Example Output:

[2023-10-15 14:22:43.123456] tcp      6 30 ESTABLISHED src=192.168.1.102 dst=203.0.113.12 sport=12345 dport=80 packets=5 bytes=2500 src=203.0.113.12 dst=192.168.1.102 sport=80 dport=12345 packets=5 bytes=3000 mark=0 use=2

This output includes a timestamp, indicating when this established connection was logged.

Use Case 4: Display a Real-Time Event Log of Connection Changes for a Specific IP Address

Code:

conntrack --event --orig-src 192.168.1.103

Motivation:

Filtering events by a specific IP address focuses the analysis on a single host, which is particularly useful for diagnosing issues affecting that system or monitoring its activity more closely.

Explanation:

• conntrack: Main command for interacting with connection tracking.
• --event: Logs connection state changes in real-time.
• --orig-src: Filters the logged events to only those originating from a specified source IP address.

Example Output:

tcp      6 300 NEW src=192.168.1.103 dst=192.0.2.25 sport=24680 dport=443 [UNREPLIED] src=192.0.2.25 dst=192.168.1.103 sport=443 dport=24680 mark=0 use=1

This output shows a new connection attempt from the specified IP address, tracking its progress.

Use Case 5: Delete All Flows for a Specific Source IP Address

Code:

conntrack --delete --orig-src 192.168.1.104

Motivation:

When a specific host needs to be temporarily or permanently disconnected, perhaps due to a security breach or other administrative reasons, deleting all connection flows associated with its IP ensures that it can no longer send or receive packets through existing connections.

Explanation:

• conntrack: Used to access and manipulate tracked connections.
• --delete: This command deletes the specified connections.
• --orig-src: Filters the connections to be deleted by the originating source IP.

Example Output:

The command itself doesn’t provide output when successful, but a typical verified success would be a check using conntrack --dump, showing no entries for the deleted IP.

Conclusion:

The conntrack command is a versatile tool that enables Linux system administrators to monitor and control network connections effectively. By leveraging its various options, admins can gain real-time insights, perform detailed analyses, and take swift actions on network connections, enhancing network security and performance.