Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Conntrack classifies a packet to a flow based on protocol no, srcip, destip, srcport, and destport.

A sample output is shown below,

[NEW] udp 17 30 src= dst= sport=57767 dport=53 [UNREPLIED] src= dst= sport=53 dport=57767

Here, what's the need of reply srcip, reply destip, reply srcport, reply destport? (Since we can imply these information from original srcp ip, original destip, original srcport, original destport) Is it just for avoiding for confusion, or anyother reasons behind this?

share|improve this question
When I asked this question in netfilter community, I was told to think about NAT. I don't understand how this works? –  Goms Aug 7 '12 at 18:15
You don't understand how what works? NAT, or what? –  Zoredache Aug 7 '12 at 19:16
Sorry for mis-communication. Netfilter community said "NAT is the reason behind the printing of reply srcip, reply dstip reply srcport, reply destport"[src= dst= sport=53 dport=57767]. I'm trying to figure out how this works? –  Goms Aug 7 '12 at 22:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.