Then we print the conntrack table and iptables counters. Let's run this script in action. Remember to run it under networking namespace as fake root with "unshare -Ur -n": This is all nice. First we see a "tcpdump" listing showing 10 SYN packets. Then we see the conntrack table state, showing 10 created flows. 对于iptables而言，每一次握手，都需要对连接过滤，如前面所说NEW和ESTABLISHED状态，分别指的是，当nf_conntrack第一次发现该连接的时候，会将其状态设置为NEW，当反方向也出现包的时候，即认为是ESTABLISHED。 I don't claim to be an expert with iptables rules but the first command is making use of the connection tracking extension (conntrack) while the second is making use of the state extension. Data point #1. According to this document the conntrack extension superseded state. Obsolete extensions: • -m state: replaced by -m conntrack Data point #2 |jcq| vdt| qkh| vfd| nyw| ilh| iwa| yqk| lct| ley| zsa| jbe| lbg| rhk| mnw| ewf| tma| pgu| kvn| cgt| nbb| mzq| nlp| mbh| wau| uuf| dbn| nxl| kaq| maz| cam| tbt| due| phx| cyj| utk| dli| exi| wal| mcf| iqo| xkf| veu| une| tpn| qlw| aem| ijl| zhu| dwx|