IPTSTATE(8)

💖 IPTSTATE — the iptstate(8) glow-up 💖

okay bestie, sit down, because this one is literally a whole vibe. this is the manual page for iptstate, a section 8 (system admin) command, and it's about to become your new obsession. 🦋

---

✨ NAME ✨

iptstate — a top-like display of IP Tables state table entries 👑

🌸 SYNOPSIS 🌸

iptstate [<options>]

💅 DESCRIPTION 💅

so iptstate shows you everything chillin' in the IP Tables state table, in real-time, in a format that's giving top but make it cute. it's live, it's dynamic, it's the moment. ✨

here's the tea: you can sort the output by any field, or reverse any field. you can make it print once and dip instead of doing the whole top-like thing. the refresh rate is configurable, IPs can be resolved to names, output can be formatted, the display can be filtered, and there's color coding — all of that is just some of the many features. no cap. 💖

🎀 COMMAND-LINE OPTIONS 🎀

• -c, --no-color — toggles the color-code by protocol 🌈
• -C, --counters — toggles the display of bytes/packets counters
• -d, --dst-filter IP[/NETMASK] — only shows states with a destination of IP, with an optional NETMASK. > heads up bestie: this has to be an IP, hostname matching is not yet supported. 💀
• -D --dstpt-filter port — only shows states with a destination port of port
• -h, --help — shows the help message 🫶
• -i, --invert-filters — inverts the filters so you see the non-matching results instead 🔄
• -l, --lookup — shows hostnames instead of IP addresses. turning this on will also turn on -L to prevent an ever-growing number of DNS requests. iykyk ✨
• -m, --mark-truncated — marks truncated hostnames with a '+'
• -o, --no-dynamic — toggles dynamic formatting
• -L, --no-dns — skips outgoing DNS lookup states
• -f, --no-loopback — filters states on loopback
• -p, --no-scroll — no scrolling (don't use a "pad"). see SCROLLING AND PADS below for the whole story 📜
• -r, --reverse — reverses the sort order 🙃
• -R, --rate seconds — refresh rate, followed by the rate in seconds. note that this is for statetop mode, and it's not applicable for single-run mode (--single).
• -1, --single — single run (no curses) 🏃♀️
• -b, --sort column — this decides what column you sort by. the options are:

     S Source Port
     d Destination IP (or Name)
     D Destination Port
     p Protocol
     s State
     t TTL
     b Bytes
     P Packets

to sort by Source IP (or Name), don't use -b. also, sorting by bytes/packets is only available for kernels that support it, and only when compiled against libnetfilter_conntrack (which is the default).

• -s, --src-filter IP[/NETMASK] — only shows states with a source of IP, with an optional NETMASK. > same warning as before, bestie: this must be an IP, hostname matching is not yet supported. 😭
• -S, --srcpt-filter port — only shows states with a source port of port
• -t, --totals — toggles the display of totals 📊

---

🦋 INTERACTIVE OPTIONS 🦋

as of version 2.0, literally all the command-line options are available interactively using the same key as the short-option. for example, --sort is also -b, so while iptstate is running, hitting b will change the sorting to the next column. same energy with t toggling the display of totals, and so on. it's giving ✨consistency✨.

there are also some extra interactive options:

• B — change sorting to the previous column (the opposite of b)
• q — quit 👋
• x — delete the currently highlighted state from the netfilter conntrack table 💀

additionally, these keys are what you use to navigate around inside iptstate:

• Up or j — move up one line
• Down or k — move down one line
• Left or h — move left one column
• Right or l — move right one column
• PageUp or ^u — move up one page
• PageDown or ^d — move down one page
• Home — go to the top ⬆️
• End — go to the end ⬇️

in a lot of cases, iptstate needs to prompt you to change something. for example, if you wanna set or change the source-ip filter, when you hit s, iptstate pops up a prompt at the top of the window asking what you wanna set it to. so polite honestly. 🫶

and like many UNIX applications, ctrl-G tells iptstate "nevermind" — it'll remove the prompt and forget you ever hit s. selective memory, iconic. 🙈

in most cases, a blank response means "clear" — clear the source IP filter, for example.

at any time while iptstate is running, you can hit h to get to the interactive help, which displays all the current settings for you and gives you a list of every interactive command available. so handy. 💖

while running, space will immediately update the display. iptstate should gracefully handle all window resizes, but if it doesn't, you can force it to re-calculate and re-draw the screen with ctrl-L.

one more thing: hitting l to enable hostname resolution while in interactive mode will also enable L to skip all DNS entries (to prevent an ever-growing number of DNS requests). 🌸

---

🌈 SCROLLING AND PADS 🌈

for almost any user, there is no reason to turn off scrolling. the ability to turn it off — and especially the ability to toggle it interactively — exists more for theoretical completeness than anything else. it's a vibe, not a necessity. 💅

but nonetheless, here are the details, because we don't gatekeep. typically in a curses application you create a "window." windows don't scroll though. they're, at most, the size of your terminal. windows provide double-buffering to make refreshing as fast and seamless as possible. however, to enable scrolling, you have to use "pads" instead of windows. pads can be bigger than the current terminal. then all the necessary data gets written to the pad, and "scrolling" becomes just a function of showing the right part of that pad on the screen. 🎀

but here's the catch: pads don't have the double-buffering feature that windows have. so there might be some case where for some user on some very strange machine, having scrolling enabled could cause poor refreshing. given the nature of the way iptstate uses the screen though, the author finds this highly unlikely. plus, the scrolling method uses a little more memory. however, iptstate is not a memory intensive application, so this shouldn't be a problem even on low-memory systems. 💖

nonetheless, if this does negatively affect you, the option to turn it off is there.

---

⭐ EXIT STATUS ⭐

anything other than 0 indicates an error. a list of the current exit statuses is below:

• 0 — success ✅
• 1 — bad command-line arguments
• 2 — error communicating with the netfilter subsystem
• 3 — terminal too narrow 😭

---

💀 BUGS 💀

we don't support filtering on resolved names. IPv6 support is new, and the dynamic formatting doesn't yet always handle IPv6 addresses as well as it should. it's a work in progress bestie, be nice. 🙈

---

🫶 BUG REPORTS 🫶

all bugs should be reported to Phil Dibowitz <phil AT ipom DOT com>. please see the README and BUGS for more information on bug reports. and please read the WISHLIST before sending in features you hope to see. 👑

---

🧚 NOTES 🧚

iptstate does a lot of work to try to fit everything on the screen in an easy-to-read way. however, in some cases, hostnames may need to be truncated (in lookup mode). similarly, IPv6 addresses may need to be truncated.

the truncation of names happens from the right for source, because you most likely know your own domain name, and from the left for destination, because knowing your users are connecting to "mail.a." doesn't help much. however, for addresses, this is reversed. ✨

iptstate does not automatically handle window-resizes while in the interactive help screen. if you do resize while in this window, you should return to the main window, hit ctrl-L to re-calculate and re-draw the screen, and then, if you choose, return to the interactive help. 🔄

iptstate currently uses libnetfilter_conntrack to access the netfilter connection state table. however, older versions read out of /proc/net/ip_conntrack, and the current version can still be compiled to do this.

⚠️ this deprecated method can be racy on SMP systems, and it can hurt performance on very heavily loaded firewalls. this deprecated method should be avoided — support will be removed in future versions. fr fr, don't do it. 💀

---

🔥 SEE ALSO 🔥

iptables(8)

---

👑 AUTHOR 👑

iptstate was written by Phil Dibowitz <phil AT ipom DOT com> http://www.phildev.net/iptstate/

---

and that's the whole page, bestie! 🎀 this one is from JUNE 2012, and it's the IPTSTATE(8) manual — go forth and watch your conntrack table in style. slay. 💅✨🦋