I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is happening in kernel only?
Shows only two established connections where as a
conntrack -L -n
Shows 18 Established connections.