libnetfilterconntrack

libnetfilter_conntrack is a userspace library that provides a programming interface for interacting with the Linux kernel’s Netfilter connection tracking subsystem, commonly known as conntrack. The library is part of the Netfilter project and communicates with the kernel through netlink sockets, using the nfnetlink framework to exchange information about connection tracking entries.

The API allows applications to enumerate existing conntrack entries, apply filters, and retrieve a range of entry attributes. Typical data retrieved includes protocol, source and destination IP addresses and ports, connection state, and timeout values. In addition to querying current connections, the library supports subscribing to connection tracking events so that programs can be notified of new, updated, or destroyed connections. This combination of querying and event notification enables building monitoring, debugging, and management tools for networked systems.

Common uses for libnetfilter_conntrack include firewall state monitoring, NAT debugging and management, intrusion detection workflows, and other network management utilities. It is often used by command-line tools such as conntrack-tools, as well as by higher-level applications that need to observe and reason about the kernel’s connection tracking data. The library relies on the underlying kernel’s conntrack subsystem and is typically packaged with libnfnetlink to facilitate netlink communication.

See also: Netfilter, nfnetlink, conntrack-tools, connection tracking.