Connection Tracking System - Revision history

Fmyhr: References: added Debian manpages for conntrack and conntrackd.

2021-04-13T01:57:31Z

References: added Debian manpages for conntrack and conntrackd.

← Older revision		Revision as of 01:57, 13 April 2021
Line 26:		Line 26:
	\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]		\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]
	\| The ''conntrack'' command line tool lets you inspect and maintain currently tracked connections.		\| The ''conntrack'' command line tool lets you inspect and maintain currently tracked connections.
	The ''conntrackd'' daemon adds support for userspace connection tracking helpers for additional L7 protocols, including DHCPv6, MDNS, SLP, SSDP, RPC, NFSv3, and Oracle TNS.		The ''conntrackd'' daemon adds support for userspace connection tracking helpers for additional L7 protocols, including DHCPv6, MDNS, SLP, SSDP, RPC, NFSv3, and Oracle TNS.<br>
			'''Note''': Unfortunately it seems the online documentation here is not kept up to date. See Debian man pages below for more recent documentation.

			\|- style="vertical-align:top;"
			\| [https://manpages.debian.org/unstable/conntrack/conntrack.8.en.html Debian man conntrack]
			[https://manpages.debian.org/unstable/conntrackd/conntrackd.8.en.html Debian man conntrackd]
			\| Recent man pages for conntrack-tools, courtesy of Debian.

	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"

Fmyhr: Link conntrack sysfs variables.

2021-04-12T01:43:36Z

Link conntrack sysfs variables.

← Older revision		Revision as of 01:43, 12 April 2021
Line 4:		Line 4:

	conntrack and nftables (and NAT) are technically distinct components of [https://www.netfilter.org/ netfilter]. Even so, conntrack is so often used together with nftables that it's worth including an overview and references to further documentation about it here.		conntrack and nftables (and NAT) are technically distinct components of [https://www.netfilter.org/ netfilter]. Even so, conntrack is so often used together with nftables that it's worth including an overview and references to further documentation about it here.

			= [https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/tree/Documentation/networking/nf_conntrack-sysctl.rst Conntrack sysfs variables] =

Fmyhr: Rewrote intro.

2021-04-12T01:37:06Z

Rewrote intro.

← Older revision		Revision as of 01:37, 12 April 2021
Line 1:		Line 1:
	nftables~~, like iptables before it,~~ uses netfilter's Connection Tracking system (often referred to as ''conntrack'' or ''ct'') to ~~identify~~ network packets ~~as belonging to new, established, related, dying, or recently-closed~~ connections. nftables ~~and conntrack are frequently used together to create~~ [https://en.wikipedia.org/wiki/Stateful_firewall stateful ~~firewalls~~]. ~~In addition, netfilter's~~ [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)] engine ([[Performing_Network_Address_Translation_(NAT)\|~~which you can~~ use ''nft'' to configure]]) ~~is built on top of conntrack. Although these~~ are technically distinct components of [https://www.netfilter.org/ netfilter], ~~they are~~ so often used together that it's ~~highly relevant~~ to ~~collect some links to ''conntrack''~~ documentation here:		nftables uses netfilter's Connection Tracking system (often referred to as ''conntrack'' or ''ct'') to associate network packets with connections and the states of those connections. An nftables ruleset performs [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalling] by applying policy based on whether or not packets are valid parts of tracked connections.

			nftables also frequently performs [https://en.wikipedia.org/wiki/Network_address_translation network address translation] using Netfilter's NAT engine, which is itself built on top of conntrack. You can [[Performing_Network_Address_Translation_(NAT)\|use ''nft'' to configure NAT]].

			conntrack and nftables (and NAT) are technically distinct components of [https://www.netfilter.org/ netfilter]. Even so, conntrack is so often used together with nftables that it's worth including an overview and references to further documentation about it here.


			= References =

	{\| class="wikitable"		{\| class="wikitable"

Fmyhr: removd spurious space

2021-02-15T21:53:44Z

removd spurious space

← Older revision		Revision as of 21:53, 15 February 2021
Line 1:		Line 1:
	nftables, like iptables before it, uses netfilter's Connection Tracking system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls]. In addition, netfilter's [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)] engine ([[Performing_Network_Address_Translation_(NAT) \| which you can use ''nft'' to configure]]) is built on top of conntrack. Although these are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:		nftables, like iptables before it, uses netfilter's Connection Tracking system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls]. In addition, netfilter's [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)] engine ([[Performing_Network_Address_Translation_(NAT)\|which you can use ''nft'' to configure]]) is built on top of conntrack. Although these are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:

	{\| class="wikitable"		{\| class="wikitable"

Fmyhr: Added link to Magnus Boye's paper, improved intro text.

2021-02-15T21:52:23Z

Added link to Magnus Boye's paper, improved intro text.

← Older revision		Revision as of 21:52, 15 February 2021
Line 1:		Line 1:
	nftables, like iptables before it, uses netfilter's ~~connection tracking~~ system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls] ~~and to perform~~ [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)]. Although ~~they~~ are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:		nftables, like iptables before it, uses netfilter's Connection Tracking system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls]. In addition, netfilter's [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)] engine ([[Performing_Network_Address_Translation_(NAT) \| which you can use ''nft'' to configure]]) is built on top of conntrack. Although these are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:

	{\| class="wikitable"		{\| class="wikitable"
Line 8:		Line 8:
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	\| [http://people.netfilter.org/pablo/docs/login.pdf ''Netfilter's Connection Tracking System'', Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006]		\| [http://people.netfilter.org/pablo/docs/login.pdf ''Netfilter's Connection Tracking System'', Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006]
	\| ~~conntrack~~ design and implementation details		\| Connection Tracking design and implementation details.

			\|- style="vertical-align:top;"
			\| [https://wiki.aalto.fi/download/attachments/69901948/netfilter-paper.pdf ''Netfilter Connection Tracking and NAT Implementation'', Magnus Boye, Aalto University School of Electrical Engineering, 2012]
			\| More details of conntrack internals. Also delves into netfilter NAT and some of its potential vulnerabilities.

	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"

Fmyhr: Added brief conntrackd description

2021-02-15T15:07:16Z

Added brief conntrackd description

← Older revision		Revision as of 15:07, 15 February 2021
Line 12:		Line 12:
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]		\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]
	\| ~~the~~ ''conntrack'' command line tool lets you inspect and maintain currently tracked connections		\| The ''conntrack'' command line tool lets you inspect and maintain currently tracked connections.
			The ''conntrackd'' daemon adds support for userspace connection tracking helpers for additional L7 protocols, including DHCPv6, MDNS, SLP, SSDP, RPC, NFSv3, and Oracle TNS.

	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"

Fmyhr: Added Oskar Andreasson's detailed into to conntrack

2021-02-15T12:12:47Z

Added Oskar Andreasson's detailed into to conntrack

← Older revision		Revision as of 12:12, 15 February 2021
Line 13:		Line 13:
	\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]		\| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]
	\| the ''conntrack'' command line tool lets you inspect and maintain currently tracked connections		\| the ''conntrack'' command line tool lets you inspect and maintain currently tracked connections

			\|- style="vertical-align:top;"
			\| [https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#STATEMACHINE ''The state machine'', Ch. 7 of Oskar Andreasson's ''Iptables Tutorial'']
			\| Detailed introduction to conntrack, albeit using legacy iptables and /proc/net/ip_conntrack (now replaced by nftables and ''conntrack'' command, respectively).

	\|}		\|}

Fmyhr: Brief summary of using nftables and conntrack together, and short list of conntrack refs.

2021-02-14T23:25:46Z

Brief summary of using nftables and conntrack together, and short list of conntrack refs.

New page

nftables, like iptables before it, uses netfilter's connection tracking system (often referred to as ''conntrack'' or ''ct'') to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls] and to perform [https://en.wikipedia.org/wiki/Network_address_translation network address translation (NAT)]. Although they are technically distinct components of [https://www.netfilter.org/ netfilter], they are so often used together that it's highly relevant to collect some links to ''conntrack'' documentation here:

{| class="wikitable"
|- style="vertical-align:bottom;"
! style="text-align:left;" | Reference
! style="text-align:left;" | Description

|- style="vertical-align:top;"
| [http://people.netfilter.org/pablo/docs/login.pdf ''Netfilter's Connection Tracking System'', Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006]
| conntrack design and implementation details

|- style="vertical-align:top;"
| [http://conntrack-tools.netfilter.org/support.html conntrack-tools documentation]
| the ''conntrack'' command line tool lets you inspect and maintain currently tracked connections

|}