Home / server / Questions / 404866
Accepted
Adrian Cornish
Asked: 2012-07-05 16:44:19 +0800 CST

Iproute2 tools vs conntrack tools

  • 772

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is happening in kernel only?

ss -na

Shows only two established connections where as a

conntrack -L -n

Shows 18 Established connections.

iptables tcpip iproute2 conntrack

1 Answers

  1. Best Answer

    ss and netstat show connections terminated at that host, i.e. either outgoing connections created by a process on the host, or incoming connections handled by a process on the host. (Technically these show you sockets.) conntrack shows connections known by the connection tracking system, which includes connections being routed by but not terminated by that host. (Sockets don't exist for connections only being routed.)

    • 5