Provide a brief description of each counter's meaning based on code-analysis in kernel's nf_conntrack_core.c and feedback from netfilter-devel list. Signed-off-by: Phil Sutter --- Changes since v1: - Update descriptions as per feedback from Florian --- conntrack.8 | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/conntrack.8 b/conntrack.8 index 2bfd80e5d6aa4..bc78c4823881c 100644 --- a/conntrack.8 +++ b/conntrack.8 @@ -108,7 +108,47 @@ Flush the whole given table Show the table counter. .TP .BI "-S, --stats " -Show the in-kernel connection tracking system statistics. +Show the in-kernel connection tracking system statistics. The returned values +for each CPU are: +.RS +.TP +.B found +Number of times a tuple was already found and had to be adjusted when setting +up a new NAT mapping. +.TP +.B invalid +Number of invalid (e.g., malformed or non-IP) packets encountered. +.TP +.B insert +Number of conntrack entries manually inserted (via netlink or eBPF). +.TP +.B insert_failed +Number of new connections dropped because of unresolvable clashes with existing +entries. +.TP +.B drop +Number of packets dropped due to memory pressure. +.TP +.B early_drop +Number of connections dropped in an attempt to recover from a full conntrack +table. +.TP +.B error +Number of invalid ICMP/ICMPv6 packets received. +.TP +.B search_restart +Number of table lookups which had to be restarted. In rare cases a lookup may +encounter an already deleted entry which causes a search restart. +.TP +.B clash_resolve +Number of entry insert clashes resolved. These happen frequently with DNS +traffic and thus not neccessarily indicate a problem. +.TP +.B chaintoolong +Number of oversized hash bucket encounters upon inserting a new conntrack +entry. This is a fatal problem for conntrack and it will drop the packet as a +consequence. +.RE .TP .BI "-R, --load-file " Load entries from a given file. To read from stdin, "\-" should be specified. -- 2.54.0