ENUM NFT_CT_KEYS(9)

🌸 enum nft_ct_keys — the kernel API manual, bestie edition 💅

okay so bestie, gather round, because this is the enum nft_ct_keys(9) page from the Kernel API Manual and it is lowkey the master list of conntrack keys that the nf_tables ct expression can grab for you ✨ every single one of these is a thing you can pull out of a connection tracking entry, and we are going to go through them all, no skips, no cap 🫶

---

✨ NAME ✨

enum nft_ct_keys — nf_tables ct expression keys 👑

---

💖 SYNOPSIS 💖

enum nft_ct_keys {
    NFT_CT_STATE ,
    NFT_CT_DIRECTION ,
    NFT_CT_STATUS ,
    NFT_CT_MARK ,
    NFT_CT_SECMARK ,
    NFT_CT_EXPIRATION ,
    NFT_CT_HELPER ,
    NFT_CT_L3PROTOCOL ,
    NFT_CT_SRC ,
    NFT_CT_DST ,
    NFT_CT_PROTOCOL ,
    NFT_CT_PROTO_SRC ,
    NFT_CT_PROTO_DST ,
    NFT_CT_LABELS ,
    NFT_CT_PKTS ,
    NFT_CT_BYTES ,
    NFT_CT_AVGPKT ,
    NFT_CT_ZONE ,
    NFT_CT_EVENTMASK ,
    NFT_CT_SRC_IP ,
    NFT_CT_DST_IP ,
    NFT_CT_SRC_IP6 ,
    NFT_CT_DST_IP6 ,
    NFT_CT_ID ,
    __NFT_CT_MAX

};

like just look at that list, it's giving organized 🧚

---

🎀 Constants 🎀

• NFT_CT_STATE — the conntrack state, which is a bitmask of enum ip_conntrack_info ⭐
• NFT_CT_DIRECTION — the conntrack direction (enum ip_conntrack_dir) 🧭
• NFT_CT_STATUS — the conntrack status, a bitmask of enum ip_conntrack_status 🔥
• NFT_CT_MARK — the conntrack mark value 🏷️
• NFT_CT_SECMARK — the conntrack secmark value 🔐
• NFT_CT_EXPIRATION — the relative conntrack expiration time, in ms ⏳
• NFT_CT_HELPER — the connection tracking helper assigned to the conntrack 🧚
• NFT_CT_L3PROTOCOL — the conntrack layer 3 protocol 🌐
• NFT_CT_SRC — the conntrack layer 3 protocol source (an IPv4/IPv6 address) — heads up bestie, this one is deprecated ⚠️
• NFT_CT_DST — the conntrack layer 3 protocol destination (an IPv4/IPv6 address) — also deprecated, yeah I know 😭
• NFT_CT_PROTOCOL — the conntrack layer 4 protocol 📦
• NFT_CT_PROTO_SRC — the conntrack layer 4 protocol source 🚀
• NFT_CT_PROTO_DST — the conntrack layer 4 protocol destination 🎯
• NFT_CT_LABELS — conntrack labels 🏷️✨
• NFT_CT_PKTS — conntrack packets 📨
• NFT_CT_BYTES — conntrack bytes 💾
• NFT_CT_AVGPKT — conntrack average bytes per packet 📊
• NFT_CT_ZONE — conntrack zone 🗺️
• NFT_CT_EVENTMASK — the ctnetlink events to be generated for this conntrack 📣
• NFT_CT_SRC_IP — conntrack layer 3 protocol source (IPv4 address) 🌈
• NFT_CT_DST_IP — conntrack layer 3 protocol destination (IPv4 address) 🌈
• NFT_CT_SRC_IP6 — conntrack layer 3 protocol source (IPv6 address) 🌈
• NFT_CT_DST_IP6 — conntrack layer 3 protocol destination (IPv6 address) 🌈
• NFT_CT_ID — the conntrack id 🆔
• __NFT_CT_MAX — -- undescribed -- 💀 yeah, the docs literally just left it blank, iconic of them ngl

---

🦋 SEE ALSO 🦋

Kernel file ./include/uapi/linux/netfilter/nf_tables.h enum, then the whole friend group 👯‍♀️: nft_registers(9), enum nft_verdicts(9), enum nf_tables_msg_types(9), enum nft_list_attributes(9), enum nft_hook_attributes(9), enum nft_table_flags(9), enum nft_table_attributes(9), enum nft_chain_attributes(9), enum nft_rule_attributes(9), enum nft_rule_compat_flags(9), enum nft_rule_compat_attributes(9), enum nft_set_flags(9), enum nft_set_policies(9), enum nft_set_desc_attributes(9), enum nft_set_field_attributes(9), enum nft_set_attributes(9), enum nft_set_elem_flags(9), enum nft_set_elem_attributes(9), enum nft_set_elem_list_attributes(9), enum nft_data_types(9), enum nft_data_attributes(9), enum nft_verdict_attributes(9), enum nft_expr_attributes(9), enum nft_immediate_attributes(9), enum nft_bitwise_ops(9), enum nft_bitwise_attributes(9), enum nft_byteorder_ops(9), enum nft_byteorder_attributes(9), enum nft_cmp_ops(9), enum nft_cmp_attributes(9), enum nft_range_ops(9), enum nft_range_attributes(9), enum nft_lookup_attributes(9), enum nft_dynset_attributes(9), enum nft_payload_bases(9), enum nft_payload_csum_types(9), enum nft_payload_attributes(9), enum nft_exthdr_op(9), enum nft_exthdr_attributes(9), enum nft_meta_keys(9), enum nft_rt_keys(9), enum nft_hash_types(9), enum nft_hash_attributes(9), enum nft_meta_attributes(9), enum nft_rt_attributes(9), enum nft_socket_attributes(9), enum nft_ct_attributes(9), enum nft_offload_attributes(9), enum nft_limit_attributes(9), enum nft_connlimit_attributes(9), enum nft_counter_attributes(9), enum nft_last_attributes(9), enum nft_log_attributes(9), enum nft_log_level(9), enum nft_queue_attributes(9), enum nft_quota_attributes(9), enum nft_secmark_attributes(9), enum nft_reject_types(9), enum nft_reject_inet_code(9), enum nft_reject_attributes(9), enum nft_nat_types(9), enum nft_nat_attributes(9), enum nft_tproxy_attributes(9), enum nft_masq_attributes(9), enum nft_redir_attributes(9), enum nft_dup_attributes(9), enum nft_fwd_attributes(9), enum nft_objref_attributes(9), enum nft_gen_attributes(9), enum nft_object_attributes(9), enum nft_flowtable_flags(9), enum nft_flowtable_attributes(9), enum nft_flowtable_hook_attributes(9), enum nft_osf_attributes(9), enum nft_synproxy_attributes(9), enum nft_devices_attributes(9), enum nft_trace_attributes(9), enum nft_ng_attributes(9). periodt. 💜

---

ngl bestie, just a lil reminder that NFT_CT_SRC and NFT_CT_DST are deprecated — reach for the _IP / _IP6 variants instead 💅

---

and that's the whole page! this lil masterpiece lives in ./include/uapi/linux/netfilter, dated October 2026, and it's titled enum nft_ct_keys(9) 🎀 go forth and conntrack, icon 👑💖