Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I haven't found any difference. For example, what it has to do with the /proc/net/nf_conntrack file?

Thanks in advance!

share|improve this question

From iptables-extensions(8):

The "net.netfilter.nf_conntrack_acct" sysctl flag controls whether new connections will be byte/packet counted. Existing connection flows will not be gaining/losing a/the accounting structure when be sysctl flag is flipped.

This accounting information can then be used to create rules for the connbytes netfilter module. Note that setting this option does not require a reboot, this can be enabled at runtime (for new connections only):

sudo sysctl -w net.netfilter.nf_conntrack_acct=1

When enabled, /proc/net/nf_conntrack will carry information about packet count and size:

 $ grep dport=1234 /proc/net/nf_conntrack
 ipv4     [...] sport=58730 dport=1234 packets=324 bytes=480352 [...]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.