Conntrack, short for connection tracking, is a firewall or router feature that keeps state about network flows. Instead of treating every packet in isolation, it remembers whether traffic belongs to an established session, a new connection, or an invalid one. This state table helps devices make faster filtering decisions and support rules such as “allow replies to outbound traffic.”
Conntrack matters because it sits on a trusted path inside network gear, so bugs in its parsing logic can become security issues. Attackers may send malformed packets or protocol data to confuse state handling, trigger crashes, or reach memory corruption in protocol-specific tracking code. In defense, administrators use conntrack-aware rules to reduce exposure, but they must also patch routers and firewalls quickly because stateful inspection code is part of the attack surface, not just a security control.