conntrack tips — authorized connection-tracking literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run conntrack on the lab host (syllabus box you own; listing needs CAP_NET_ADMIN).
2. Prefer documenting who / why / ticket before any dump/flush — never flush production tables without change control.
3. Record short factual notes; quote short Evidence (entry count + selected lab tuples — never secrets).
4. Optional: filter peer → iptables-tips / nft-tips.
5. Optional: socket peer → ss-tips when the syllabus compares sockets vs conntrack.
6. Prefer disposable lab VMs generating known lab flows for conntrack drills; quote non-secret labels afterward as Evidence.
7. Prefer conntrack -C / conntrack -S read-back before full -L — refuse unauthorized foreign-dump cookbooks.
8. Stop at literacy — no attack or unauthorized network-bypass cookbooks.

Allowed framing

• Classroom labs reviewing conntrack -L -o extended on disposable hosts with known lab flows.
• Binding short factual notes as Evidence (counts + lab tuples — no secrets).
• Documenting expected vs observed entry counts for authorized notes.
• Comparing conntrack ↔ iptables / nft / ipset / ss peer tip pages under one binder.
• Testing syllabus-approved lab-conntrack only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via conntrack.
• No intentional unauthorized dumps against foreign hosts.
• No secret-theft or credential harvesting against hosts you do not own.
• No cookbooks that use conntrack flush as an attack step against production without authorization.
• No conntrack framed as a network-bypass against systems you do not own.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with conntrack-tools available.
2. Prefer generating a few known lab TCP/UDP flows before listing.
3. With authorization, run conntrack -C then a filtered -L; quote selected labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized network-bypass cookbooks.

Practical notes for authorized labs

• conntrack reads the kernel connection table — keep Evidence labels distinct from ss-tips (conntrack ≠ sockets).
• Pair with ipset-tips when the syllabus zooms on set-based vs stateful matching.
• conntrack -S stats are a great read-back drill — document selected counters without dumping entire production tables.
• Prefer documenting counts and redacted lab tuples the syllabus authorized.
• Never commit conntrack dumps with secrets or proprietary flow inventories to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host conntrack dump → refuse.
• Unauthorized network-bypass / hostile-flush attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources