Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

Conntrack classifies a packet to a flow based on protocol no, srcip, destip, srcport, and destport.

A sample output is shown below,

[NEW] udp 17 30 src=192.168.2.100 dst=192.168.2.1 sport=57767 dport=53 [UNREPLIED] src=192.168.2.1 dst=192.168.2.100 sport=53 dport=57767

Here, what's the need of reply srcip, reply destip, reply srcport, reply destport? (Since we can imply these information from original srcp ip, original destip, original srcport, original destport) Is it just for avoiding for confusion, or anyother reasons behind this?

share|improve this question
When I asked this question in netfilter community, I was told to think about NAT. I don't understand how this works? – Goms Aug 7 '12 at 18:15
You don't understand how what works? NAT, or what? – Zoredache Aug 7 '12 at 19:16
Sorry for mis-communication. Netfilter community said "NAT is the reason behind the printing of reply srcip, reply dstip reply srcport, reply destport"[src=192.168.2.1 dst=192.168.2.100 sport=53 dport=57767]. I'm trying to figure out how this works? – Goms Aug 7 '12 at 22:33

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.