View source for Connection Tracking System

nftables, like iptables before it, uses netfilter's connection tracking system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls] and to perform [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)]. Although they are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:

{| class="wikitable"
|- style="vertical-align:bottom;"
! style="text-align:left;" | Reference
! style="text-align:left;" | Description

|- style="vertical-align:top;"
| [http://people.netfilter.org/pablo/docs/login.pdf  ''Netfilter's Connection Tracking System'', Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006]
| conntrack design and implementation details

|- style="vertical-align:top;"
| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]
| the ''conntrack'' command line tool lets you inspect and maintain currently tracked connections

|- style="vertical-align:top;"
| [https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#STATEMACHINE ''The state machine'', Ch. 7 of Oskar Andreasson's ''Iptables Tutorial'']
| Detailed introduction to conntrack, albeit using legacy iptables and /proc/net/ip_conntrack (now replaced by nftables and ''conntrack'' command, respectively).

|}