0

I noticed the following today on our router:

user@router:~$ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count 
28141

However:

user@router:~$ sudo conntrack -L > /dev/null 
conntrack v1.2.1 (conntrack-tools): 4652 flow entries have been shown.

user@router:~$ sudo conntrack -L expect > /dev/null 
conntrack v1.2.1 (conntrack-tools): 1 expectations have been shown.

My understanding is that ip_conntrack_count shows the number of entries of the conntrack table. What am I missing?

dorian
  • 397
  • 1
  • 7
  • 22

1 Answers1

0

The answer is that conntrack only lists IPv4 connections by default. If I do

user@router:~$ sudo conntrack -L -f ipv6 > /dev/null 
conntrack v1.2.1 (conntrack-tools): 23864 flow entries have been shown.

user@router:~$ sudo conntrack -L  > /dev/null 
conntrack v1.2.1 (conntrack-tools): 6713 flow entries have been shown.

then the sum of the two results add up to the number in /proc/sys/net/ipv4/netfilter/ip_conntrack_count.

The pathname of this proc entry is actually pretty misleading as the count is for both IPv4 and IPv6.

dorian
  • 397
  • 1
  • 7
  • 22