Connection tracking, often called conntrack, is the state table a firewall, router, or NAT device uses to remember active flows. Instead of treating every packet in isolation, the device records details such as source and destination addresses, ports, protocol, and session state so return traffic can be matched and rewritten consistently.
This matters because many network defenses depend on that state to enforce per-connection rules. If the table is unstable, overloaded, or manipulated, traffic can be misclassified, sessions can be disrupted, and in some cases an attacker may steer packets into the wrong flow. In attacks against NAT or other stateful edge devices, conntrack becomes part of the target surface: weak validation or bad state transitions can enable session hijacking, DNS tampering, or denial of service. Defenders should monitor for abnormal state churn and treat connection-tracking logic as security-critical infrastructure.