NFCT(8) NFCT(8)

# [NAME](#NAME)

nfct - command line tool to configure with the connection tracking system

# [SYNOPSIS](#SYNOPSIS)

**nfct command subsystem \[parameters]**

# [DESCRIPTION](#DESCRIPTION)

**nfct** is the command line tool that allows you to configure the Connection Tracking System.

# [COMMANDS](#COMMANDS)

[**list**](#list)

List the existing objects.

[**add**](#add)

Add new object.

[**delete**](#delete)

Delete an object.

[**get**](#get)

Get an existing object.

[**flush**](#flush)

Flush the accounting object table.

[**disable**](#disable)

This command is for the helper subsystem. It allows you to disable enqueueing packets to userspace for helper inspection.

[**default-set**](#default-set)

This command is for the timeout subsystem. It allows you to set default protocol timeouts.

[**default-get**](#default-get)

This command is for the timeout subsystem. It allows you to get the default protocol timeouts.

# [SUBSYS](#SUBSYS)

By the time this manpage has been written, the supported subsystems are **timeout** and **helper.**

[**timeout**](#timeout)

The timeout subsystem allows you to define fine-grain timeout policies.

[**helper**](#helper)

The helper subsystem allows you to configure userspace helpers.

[**version**](#version)

Displays the version information.

[**help**](#help)

Displays the help message.

# [EXAMPLE](#EXAMPLE)

[**nfct add timeout test-tcp inet tcp established 100 close 10 close\_wait 10**](#nfct)

[This creates a timeout policy for tcp using 100 seconds for the ESTABLISHED state, 10 seconds for CLOSE state and 10 seconds for the CLOSE\_WAIT state.](#This)

[Then, you can attach the timeout policy with the iptables CT target:](#Then,)

[**iptables -I PREROUTING -t raw -p tcp -j CT --timeout test-tcp**](#iptables)

[**iptables -I OUTPUT -t raw -p tcp -j CT --timeout test-tcp**](#iptables~2)

[You can test that the timeout policy with:](#You)

[**conntrack -E -p tcp**](#conntrack)

[It should display:](#It)

**\[UPDATE] tcp 6 100 ESTABLISHED src=192.168.39.100 dst=57.126.1.20 sport=56463 dport=80 src=57.126.1.20 dst=192.168.39.100 sport=80 dport=56463 \[ASSURED]**

# [SEE ALSO](#SEE_ALSO)

[**iptables**(8)](/man/os/conntrack-tools/iptables.8),[**conntrack**(8)](/man/os/conntrack-tools/conntrack.8)

# [BUGS](#BUGS)

Please, report them to netfilter-devel@vger.kernel.org or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org).

# [AUTHORS](#AUTHORS)

Pablo Neira Ayuso wrote and maintains the nfct tool.

Man page written by Pablo Neira Ayuso <pablo@netfilter.org>.

February 29, 2012

---

Document: nfct(8) from conntrack-tools 1.4.9-r3 (Chainguard OS)
Source: git://git.netfilter.org/conntrack-tools/