Network traffic

Real time each connection tracking (Conntrack)

In freebsd, session table provides real time rx/tx information for each connection. InLinux netfilter router, connections table only includes information on end of connections by default.

from Linux kernel version >= 2.6.18, we can use conntract or conntrackd daemon, This tool can be used tosearch, list, inspect and maintain the connection tracking subsystem of the Linux kernel.

conntrack module traces the connection status of trackable protocols (specific protocols, not all.)

setup conntrack

Set nf_contrack_acct

$ sysctl -w net.netfilter.nf_conntrack_acct=1

Install contrack utility, if you do not have yet

$sudo apt-get install conntrack

List the existing flows

# conntrack -L

Filter out the listing

#conntrack -L -p tcp --dport 22

Update the ct mark

#conntrack -U -p tcp --dport 22 --mark 10

delete entries,

it can also block TCP traffic when

• stateful rule-set that drops traffic in INVALID state
• /proc/sys/net/netfilter/nf_conntrack_tcp_loose to zero.
• # conntrack -D -p tcp --dport 22

Listen to the connection tracking events

#conntrack -E