1This module, when combined with connection tracking, allows access to 2more connection tracking information than the "state" match. 3(this module is present only if iptables was compiled under a kernel 4supporting this feature) 5.TP 6.BI "--ctstate " "state" 7Where state is a comma separated list of the connection states to 8match. Possible states are 9.B INVALID 10meaning that the packet is associated with no known connection, 11.B ESTABLISHED 12meaning that the packet is associated with a connection which has seen 13packets in both directions, 14.B NEW 15meaning that the packet has started a new connection, or otherwise 16associated with a connection which has not seen packets in both 17directions, and 18.B RELATED 19meaning that the packet is starting a new connection, but is 20associated with an existing connection, such as an FTP data transfer, 21or an ICMP error. 22.B SNAT 23A virtual state, matching if the original source address differs from 24the reply destination. 25.B DNAT 26A virtual state, matching if the original destination differs from the 27reply source. 28.TP 29.BI "--ctproto " "proto" 30Protocol to match (by number or name) 31.TP 32.BI "--ctorigsrc " "[!] \fIaddress\fP[/\fImask\fP]" 33Match against original source address 34.TP 35.BI "--ctorigdst " "[!] \fIaddress\fP[/\fImask\fP]" 36Match against original destination address 37.TP 38.BI "--ctreplsrc " "[!] \fIaddress\fP[/\fImask\fP]" 39Match against reply source address 40.TP 41.BI "--ctrepldst " "[!] \fIaddress\fB[/\fImask\fP]" 42Match against reply destination address 43.TP 44.BI "--ctstatus " "[\fINONE|EXPECTED|SEEN_REPLY|ASSURED\fP][,...]" 45Match against internal conntrack states 46.TP 47.BI "--ctexpire " "\fItime\fP[\fI:time\fP]" 48Match remaining lifetime in seconds against given value 49or range of values (inclusive) 50