conntrack-tools

Use a filtered listing for the current state table or the event view for NEW and UPDATE activity. The manual’s examples show original and reply addresses, ports, state, marks and counters; these describe the Linux host’s connection-tracking view. Updating marks or deleting entries changes that state, so those commands serve a different purpose from observation. The package needs kernel connection-tracking and Netlink support plus libnfnetlink and libnetfilter_conntrack; administrative access is part of the documented examples. conntrackd is a separate daemon role within the package. Its high-availability setup adds a working HA manager, a dedicated synchronization link and an appropriate stateful ruleset, rather than turning a single listing into a synchronized firewall.