nfconntrack

nfconntrack, short for Netfilter connection tracking, is the Linux kernel subsystem responsible for maintaining state information about active network connections as they pass through the system. It is a core component of the Netfilter framework and underpins stateful firewalling and network address translation (NAT).

The subsystem keeps a conntrack table containing one entry per active connection. Each entry records the 5-tuple (source and destination IP addresses, protocol, source and destination ports), together with state information, timers, counters, and associated statistics. Connection states typically include NEW, ESTABLISHED, RELATED, and various transitional or INVALID states. As packets traverse the stack, nfconntrack updates, creates, or expires entries, enabling subsequent packets to be matched against existing state rather than treated as new traffic.

nfconntrack supports NAT in addition to tracking, enabling dynamic port and address translation for connections. It also includes protocol-specific NAT helpers for applications that negotiate auxiliary connections (for example FTP, SIP, and H.323). These helpers assist in correctly tracking and translating control and data channels that may use dynamically allocated ports.

Management and usage are commonly performed through user-space tools such as conntrack-tools or through high-level firewall frameworks like iptables or nftables. The kernel exposes the conntrack table via interfaces such as procfs or netlink, and administrators can query, flush, or modify entries as needed. Configuration controls include limits on the maximum number of tracked connections and various timeout values for different connection states.

nfconntrack is implemented for both IPv4 and IPv6 within Netfilter. It replaced older ip_conntrack functionality and is integral to stateful filtering and NAT in many Linux deployments.