CONNTRACKD(8)

CONNTRACKD 💖

okay bestie, buckle up — this is the conntrackd manual, straight out of section 8 of your friendly neighbourhood Unix docs (that's the sysadmin-commands section, iykyk). It's a whole daemon and she is booked and busy. Let's get into it ✨

---

🌸 NAME 🌸

conntrackd — the netfilter connection tracking user-space daemon 💅

---

✨ SYNOPSIS ✨

conntrackd [options]

---

🦋 DESCRIPTION 🦋

So conntrackd is the user-space daemon for the netfilter connection tracking system. Her whole job? Synchronizing connection tracking states between several replica firewalls. Which means — and this is the slay part — conntrackd can be used to deploy highly available stateful firewalls. Main character energy fr fr 🔥

The daemon supports Primary-Backup and Multiprimary setups, and she can also be used as a statistics collector. Versatile queen 👑

---

💅 OPTIONS 💅

The options recognized by conntrackd can be divided into two different groups. Two groups, bestie. That's the whole vibe check.

🎀 GEMERAL OPTIONS 🎀

General options for the conntrackd daemon. (yes the original heading says "GEMERAL", we do not fix her, we respect her 💖)

• -d — Run conntrackd in daemon mode (fork to background). She's leaving the group chat to go do her own thing 🌙
• -C <path> — Load config file specified in path. See conntrackd.conf(5) for details. Gotta read the lore first 📖
• -v — Display version information.
• -h — Display help information. Asking for help is self-care, no cap 🫶

🌈 CLIENT COMMANDS 🌈

conntrackd can be used in client mode to request several information and operations to a running instance of the daemon. So basically you can slide into a running daemon's DMs and ask her stuff 📲

• -i [ct|expect] — Dump the internal cache, i.e. show local states 👀
• -e [ct|expect] — Dump the external cache, i.e. show foreign states 🌍
• -x — Display output in XML format. > Heads up: this option is only valid in combination with -i and -e parameters. Don't try it solo, she won't answer 💀
• -f [internal|external] — Flush the internal and/or external cache 🚿
• -F [ct|expect] — Flush the kernel conntrack table. > Ngl, note this: if you use a Linux kernel >= 2.6.29, this option will not flush your internal and external cache. Read the fine print bestie 😭
• -c — Commit external cache to conntrack table. Making it official 💍
• -B — Force a bulk send to other replica firewalls. With this command, you will ask conntrackd to send the state-entries that it owns to others. Sharing is caring ✨
• -n — Request resync with other node (only FT-FW and NOTRACK modes).
• -k — Kill the daemon 💀 (sorry bestie, sometimes you gotta)
• -s [network|cache|runtime|link|rsqueue|process|queue|ct|expect] — Dump statistics. If no parameter is passed, it displays the general statistics.
  • If network is passed as parameter it displays the networking statistics.
  • If cache is passed as parameter, it shows the extended cache statistics.
  • If runtime is passed as parameter, it shows the run-time statistics.
  • If process is passed as parameter, it shows existing child processes (if any).
  • If queue is passed as parameter, it shows queue statistics.
  • If ct is passed, it displays the general statistics.
  • If expect is passed as parameter, it shows expectation statistics.
• -R [ct|expect] — Force a resync against the kernel connection tracking table 🔄
• -t — Reset the in-kernel timers (See PurgeTimeout clause) ⏰

---

🩺 DIAGNOSTICS 🩺

The exit code is 0 for correct function. Errors cause an exit code of 1. She's a simple girl: 0 means we're thriving, 1 means something's off 😤

---

🍓 EXAMPLES 🍓

The following example are illustrative, for a real use in a firewall fail-over, check the primary-backup.sh script that comes with the sources. These are the demo versions, bestie — the real deal lives in that script 💖

conntrackd -d

Runs conntrackd in daemon and synchronization mode 🚀

conntrackd -i

Dumps the states held in the internal cache, i.e. those handled by this firewall 🏠

conntrackd -e

Dumps the states held in the external cache, i.e. those handled by other replica firewalls 🌐

conntrackd -c

Commits the external cache into the kernel connection tracking system. This is used to inject the state so that the connections can be recovered during the failover. The glow-up moment ✨

---

🧚 DEPENDENCIES 🧚

This daemon requires a Linux kernel version >= 2.6.18. TCP window tracking support requires >= 2.6.22, otherwise you have to disable it. Helpers are fully supported since >= 2.6.25, however, if you use any previous version, depending on the protocol helper and your setup (e.g. if you setup performs NAT sequence adjustments or not), your help connection may be successfully recovered.

There are several unsupported stateful iptables matches such as recent, connbytes and the quota matches which gather internal information to operate. Since that information does not belong to the domain of the connection tracking system, connections affected by those matches may not be fully recovered during the takeover. > So like… those ones might not make it back. Not her fault, it's outside her domain 🫠

The daemon requires a Linux kernel version >= 2.6.26 to support kernel-space event filtering. Otherwise, all the event filtering is done in userspace with the corresponding extra overhead. If you are not using the Filter clause in the configuration file, ignore this notice. (Ignoring it is valid 💅)

---

🌟 SYSTEMD INTEGRATION 🌟

Starting with the 1.4.4 release, conntrackd includes integration with systemd(1) to use an unit file of Type=notify and watchdog support. She's modern, she's integrated, she talks to systemd directly 😌

---

🙈 INCOMPATIBILITIES 🙈

During the 0.9.9 development, some important changes in the replication message format were introduced. Therefore, conntrackd >= 0.9.9 will not work appropriately with conntrackd <= 0.9.8. Not me pointing out the version drama 😭

This should not be a problem if you use the same conntrackd version in all the firewall replica nodes. Matching fits, matching vibes, periodt 👑

---

🔗 SEE ALSO 🔗

• conntrackd.conf(5)
• conntrack(8)
• iptables(8)
• nft(8)
• http://conntrack-tools.netfilter.org

---

🐛 BUGS 🐛

Please, report them to netfilter-devel@vger.kernel.org (subscription required) or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org). Do NOT suffer in silence bestie, tell the devs 💌

---

👑 AUTHORS 👑

Pablo Neira Ayuso wrote and maintains the conntrackd tool 🫶

Man page written by Pablo Neira Ayuso <pablo@netfilter.org>.

---

and that's the whole page, babes 💖 this one's from Apr 16, 2018, CONNTRACKD(8), and it lives in the conntrack-tools sources. go forth and keep those firewalls highly available, you absolute icon 🌈✨