diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-05-21 21:34:08 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-05-22 15:19:44 +0300 |
| commit | 447b0bd6e804896506d3eb65f01856f82c8b9af7 (patch) | |
| tree | 2e382350c4cb8bf82213e9f8fa657098caeaf59f | |
| parent | ddee034eedac71a45d7a92d5207be14f5fd7a618 (diff) | |
| download | vyos-documentation-447b0bd6e804896506d3eb65f01856f82c8b9af7.tar.gz vyos-documentation-447b0bd6e804896506d3eb65f01856f82c8b9af7.zip | |
conntrack: T8308: Enhancements to the `show conntrack table` op-mode command
- Display per-flow packet and byte counters (original and reply
direction).
- Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`.
| -rw-r--r-- | docs/configuration/service/conntrack-sync.md | 29 |
1 files changed, 16 insertions, 13 deletions
diff --git a/docs/configuration/service/conntrack-sync.md b/docs/configuration/service/conntrack-sync.md index 4aad6283..61fa7034 100644 --- a/docs/configuration/service/conntrack-sync.md +++ b/docs/configuration/service/conntrack-sync.md @@ -149,32 +149,35 @@ the other node at startup. ## Operation -```{opcmd} show conntrack table ipv4 +```{opcmd} show conntrack table \<ipv4|ipv6\> Make sure conntrack is enabled by running and show connection tracking table. :::{code-block} none vyos@vyos:~$ show conntrack table ipv4 -TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED, -FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK, -TW - TIME WAIT, CL - CLOSE, LI - LISTEN - -CONN ID Source Destination Protocol TIMEOUT -1015736576 10.35.100.87:58172 172.31.20.12:22 tcp [6] ES 430279 -1006235648 10.35.101.221:57483 172.31.120.21:22 tcp [6] ES 413310 -1006237088 10.100.68.100 172.31.120.21 icmp [1] 29 -1015734848 10.35.100.87:56282 172.31.20.12:22 tcp [6] ES 300 -1015734272 172.31.20.12:60286 239.10.10.14:694 udp [17] 29 -1006239392 10.35.101.221 172.31.120.21 icmp [1] 29 +Id Original src Original dst Original packets Original bytes Reply src Reply dst Reply packets Reply bytes Protocol State Timeout Mark Zone +---------- -------------- -------------- ------------------ ---------------- ------------ -------------- --------------- ------------- ---------- ----------- --------- ------ ------ +282920088 10.0.2.2:41724 10.0.2.15:22 79 8741 10.0.2.15:22 10.0.2.2:41724 52 8495 tcp TIME_WAIT 3 0 +102466872 192.168.50.1 192.168.50.4 31953 2684052 192.168.50.4 192.168.50.1 31953 2684052 icmp 29 0 110 +1445684978 10.0.2.2:37762 10.0.2.15:22 111 9969 10.0.2.15:22 10.0.2.2:37762 86 13323 tcp ESTABLISHED 431999 0 +3302843234 10.0.2.2:37758 10.0.2.15:22 2612 3845685 10.0.2.15:22 10.0.2.2:37758 254 17447 tcp TIME_WAIT 11 0 ::: :::{note} If the table is empty and you have a warning message, it means conntrack is not enabled. To enable conntrack, just create a NAT or a firewall -rule. {cfgcmd}`set firewall state-policy established action accept` +rule. +{cfgcmd}`set firewall global-options state-policy established action accept` ::: ``` +```{opcmd} show conntrack table \<ipv4|ipv6\> vrf \<vrf-name\> + +Show connection tracking table filtered by VRF name. Only entries originating +from the specified VRF are displayed. +``` + + ```{opcmd} show conntrack-sync cache external Show connection syncing external cache entries |