/usr/bin/conntrack --help — Chainguard OS Manuals

From conntrack-tools 1.4.9-r3 (os), captured 2026-11-05 by running conntrack --help (exit 0). permalink

Command line interface for the connection tracking system. Version 1.4.9
Usage: /usr/bin/conntrack [commands] [options]

Commands:
  -L [table] [options]		List conntrack or expectation table
  -G [table] parameters		Get conntrack or expectation
  -D [table] parameters		Delete conntrack or expectation
  -I [table] parameters		Create a conntrack or expectation
  -U [table] parameters		Update a conntrack
  -E [table] [options]		Show events
  -F [table]			Flush table
  -C [table]			Show counter
  -S				Show statistics

Tables: conntrack, expect, dying, unconfirmed

Conntrack parameters and options:
  -n, --src-nat ip			source NAT ip
  -g, --dst-nat ip			destination NAT ip
  -j, --any-nat ip			source or destination NAT ip
  -m, --mark mark			Set mark
  -c, --secmark secmark			Set selinux secmark
  -e, --event-mask eventmask		Event mask, eg. NEW,DESTROY
  -z, --zero 				Zero counters while listing
  -o, --output type[,...]		Output format, eg. xml
  -l, --label label[,...]		conntrack labels
  --labelmap path			connlabel file to use instead of default

Expectation parameters and options:
  --tuple-src ip	Source address in expect tuple
  --tuple-dst ip	Destination address in expect tuple

Updating parameters and options:
  --label-add label	Add label
  --label-del label	Delete label

Common parameters and options:
  -s, --src, --orig-src ip		Source address from original direction
  -d, --dst, --orig-dst ip		Destination address from original direction
  -r, --reply-src ip		Source address from reply direction
  -q, --reply-dst ip		Destination address from reply direction
  -p, --protonum proto		Layer 4 Protocol, eg. 'tcp'
  -f, --family proto		Layer 3 Protocol, eg. 'ipv6'
  -t, --timeout timeout		Set timeout
  -u, --status status		Set status, eg. ASSURED
  -w, --zone value		Set conntrack zone
  --orig-zone value		Set zone for original direction
  --reply-zone value		Set zone for reply direction
  -b, --buffer-size		Netlink socket buffer size
  --mask-src ip			Source mask address
  --mask-dst ip			Destination mask address

Options (53)

Option	Description	Source
`-L` table	List connection tracking or expectation table	help + man
`-G, --get` table	Search for and show a particular (matching) entry in the given table.	help + man
`-D, --delete` table	Delete an entry from the given table.	help + man
`-I, --create` table	Create a new entry from the given table, it fails if it already exists.	help + man
`-U, --update` table	Update an entry from the given table.	help + man
`-E, --event` table	Display a real-time event log.	help + man
`-F, --flush` table	Flush the whole given table	help + man
`-C, --count` table	Show the table counter.	help + man
`-S, --stats`	Show the in-kernel connection tracking system statistics.	help + man
`-n, --src-nat` ip	Filter source NAT connections.	help + man
`-g, --dst-nat` ip	Filter destination NAT connections.	help + man
`-j, --any-nat` ip	source or destination NAT ip	help + man
`-m, --mark` mark	Set mark	help
`-c, --secmark` secmark	Specify the conntrack selinux security mark.	help + man
`-e, --event-mask` eventmask	Event mask, eg.	help
`-z, --zero`	Atomically zero counters after reading them.	help + man
`-o, --output` type	Output format, eg.	help
`-l, --label` label	Specify a conntrack label.	help + man
`--labelmap` path	Specify the path to a connlabel.conf file to load instead of the default one.	help + man
`--tuple-src` ip	Specify the tuple source address of an expectation.	help + man
`--tuple-dst` ip	Specify the tuple destination address of an expectation.	help + man
`--label-add` label	Specify the conntrack label to add to the selected conntracks.	help + man
`--label-del` label	Delete label	help
`-s, --src, --orig-src` ip	Match only entries whose source address in the original direction equals the one specified as argument.	help + man
`-d, --dst, --orig-dst` ip	Match only entries whose destination address in the original direction equals the one specified as argument.	help + man
`-r, --reply-src` ip	Match only entries whose source address in the reply direction equals the one specified as argument.	help + man
`-q, --reply-dst` ip	Match only entries whose destination address in the reply direction equals the one specified as argument.	help + man
`-p, --protonum, --proto` proto	Specify layer four (TCP, UDP, ...) protocol.	help + man
`-f, --family` proto	Specify layer three (ipv4, ipv6) protocol.	help + man
`-t, --timeout` timeout	Specify the timeout.	help + man
`-u, --status` status	Set status, eg.	help
`-w, --zone` value	Filter by conntrack zone.	help + man
`--orig-zone` value	Filter by conntrack zone in original direction.	help + man
`--reply-zone` value	Filter by conntrack zone in reply direction.	help + man
`-b, --buffer-size` value	Set the Netlink socket buffer size in bytes.	help + man
`--mask-src` ip	Specify the source address mask.	help + man
`--mask-dst` ip	Specify the destination address mask.	help + man
`-A, --add`	Add a new entry from the given table. (in the manual page but not in --help)	man
`-R, --load-file`	Load entries from a given file. (in the manual page but not in --help)	man
`--sport, --orig-port-src` PORT	Source port in original direction (in the manual page but not in --help)	man
`--dport, --orig-port-dst` PORT	Destination port in original direction (in the manual page but not in --help)	man
`--reply-port-src` PORT	Source port in reply direction (in the manual page but not in --help)	man
`--reply-port-dst` PORT	Destination port in reply direction (in the manual page but not in --help)	man
`--state` state	TCP state, one of NONE, SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE or LISTEN. (in the manual page but not in --help)	man
`--icmp-type` TYPE	ICMP Type. (in the manual page but not in --help)	man
`--icmp-code` CODE	ICMP Code. (in the manual page but not in --help)	man
`--icmp-id` ID	ICMP Id. (in the manual page but not in --help)	man
`--orig-vtag` value	Verification tag (32-bits value) in the original direction (in the manual page but not in --help)	man
`--reply-vtag` value	Verification tag (32-bits value) in the reply direction (in the manual page but not in --help)	man
`--srckey, --orig-key-src` KEY	Source key in original direction (in hexadecimal or decimal) (in the manual page but not in --help)	man
`--dstkey, --orig-key-dst` KEY	Destination key in original direction (in hexadecimal or decimal) (in the manual page but not in --help)	man
`--reply-key-src` KEY	Source key in reply direction (in hexadecimal or decimal) (in the manual page but not in --help)	man
`--reply-key-dst` KEY	Destination key in reply direction (in hexadecimal or decimal) (in the manual page but not in --help)	man

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.