Connection Tracking System

nftables, like iptables before it, uses netfilter's connection tracking system (often referred to as conntrack or ct) to identify network packets as belonging to new, established, related, dying, or recently-closed connections. nftables and conntrack are frequently used together to create stateful firewalls and to perform network address translation (NAT). Although they are technically distinct components of netfilter, they are so often used together that it's highly relevant to collect some links to conntrack documentation here:

Reference	Description
Netfilter's Connection Tracking System, Pablo Neira Ayuso, ;login: Vol. 31 No. 3, 2006	conntrack design and implementation details
conntrack-tools documentation	The conntrack command line tool lets you inspect and maintain currently tracked connections. The conntrackd daemon adds support for userspace connection tracking helpers for additional L7 protocols, including DHCPv6, MDNS, SLP, SSDP, RPC, NFSv3, and Oracle TNS.
The state machine, Ch. 7 of Oskar Andreasson's Iptables Tutorial	Detailed introduction to conntrack, albeit using legacy iptables and /proc/net/ip_conntrack (now replaced by nftables and conntrack command, respectively).