NFCT(8)

💖 NFCT(8) — the connection tracking glow-up 💖

okay so bestie, say hi to nfct — it's the command line tool that lets you configure the Connection Tracking System. yes, the whole thing. from your terminal. iconic behaviour honestly. 🦋

---

✨ SYNOPSIS ✨

nfct command subsystem [parameters]

that's it, that's the shape of it. a command, then a subsystem, then whatever parameters you're feeling. 💅

---

🌸 DESCRIPTION 🌸

nfct is the command line tool that lets you configure the Connection Tracking System. lowkey it's the little remote control for your conntrack setup and it ate. 🔥

---

👑 COMMANDS 👑

• list — lists the objects that already exist. a little show-and-tell. 👀
• add — adds a new object. new object, who dis. ✨
• delete — deletes an object. bye bestie 🫶
• get — gets an existing object. grabby hands, but make it sysadmin. 🙈
• flush — flushes the accounting object table. yes, all of it. gone. 💀
• disable — this one is for the helper subsystem. it lets you disable enqueueing packets to userspace for helper inspection. like, no more sending packets upstairs for a vibe check. 🚫
• default-set — this one is for the timeout subsystem. it lets you set default protocol timeouts. ⏰
• default-get — also for the timeout subsystem. it lets you get the default protocol timeouts. reading the room, timeout-wise. 📖

---

🧚 SUBSYS 🧚

as of when this manpage was written, the supported subsystems are timeout and helper. that's the whole roster, no cap.

• timeout — this subsystem lets you define fine-grain timeout policies. very detail-oriented, very main character. 💜
• helper — this subsystem lets you configure userspace helpers. 🤝
• version — displays the version information. ⭐
• help — displays the help message. when in doubt, ask for help bestie. 🌈

---

🎀 EXAMPLE 🎀

nfct add timeout test-tcp inet tcp established 100 close 10 close_wait 10

so what's happening here? this creates a timeout policy for tcp using 100 seconds for the ESTABLISHED state, 10 seconds for the CLOSE state, and 10 seconds for the CLOSE_WAIT state. she's precise. she's punctual. she has a schedule. ⏱️

then, you can attach that timeout policy with the iptables CT target:

iptables -I PREROUTING -t raw -p tcp -j CT --timeout test-tcp

iptables -I OUTPUT -t raw -p tcp -j CT --timeout test-tcp

and you can test that timeout policy with:

conntrack -E -p tcp

it should display:

[UPDATE] tcp 6 100 ESTABLISHED src=192.168.39.100 dst=57.126.1.20
sport=56463 dport=80 src=57.126.1.20 dst=192.168.39.100 sport=80
dport=56463 [ASSURED]

periodt. that's the whole flow and it works. 💅✨

---

🌟 SEE ALSO 🌟

iptables(8), conntrack(8)

go read those too, they're the friend group. 🫶

---

💀 BUGS 💀

found something cursed? please, report them to netfilter-devel@vger.kernel.org or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org). don't just suffer in silence bestie, tell the devs. 😭

---

💜 AUTHORS 💜

Pablo Neira Ayuso wrote and maintains the nfct tool. 👑

Man page written by Pablo Neira Ayuso <pablo@netfilter.org>.

---

so yeah, that's the whole page. nfct(8), coming at you from Feb 29, 2012, and this is the NFCT(8) manual in the building. stan a conntrack tool. bye bestie, go configure something. 💖🎀🦋🌸