Connection tracking refers to the ability to maintain the state information about connections, such
as source and destination IP address and ports pairs, connection states, protocol types and timeouts.
Firewalls that do connection tracking are known as "stateful" and are inherently more secure that
those who do only simple "stateless" packet processing.
The state of a particular connection could be estabilished meaning that the packet is part of already
known connection, new meaning that the packet starts a new connection or belongs to a connection
that has not seen packets in both directions yet, related meaning that the packet starts a new
connection, but is associated with an existing connection, such as FTP data transfer or ICMP error
message and, finally, invalid meaning that the packet does not belong to any known connection
and, at the same time, does not open a valid new connection.
Connection tracking is done in the prerouting chain, or the output chain for locally generated
packets.
Another function of connection tracking which cannot be overestimated is that it is needed for
NAT. You should be aware that no NAT can be performed unless you have connection tracking
enabled, the same applies for p2p protocols recognition. Connection tracking also assembles IP
packets from fragments before further processing.
The maximum number of connections the /ip firewall connection state table can contain is
determined initially by the amount of physical memory present in the router. Thus, for example, a
router with 64 MB of RAM can hold the information about up to 65536 connections, but a router
with 128 MB RAM increases this value to more than 130000.
Please ensure that your router is equipped with sufficient amount of physical memory to properly
handle all connections.
Property Description
assured ( read-only: true | false ) - shows whether replay was seen for the last packet matching this
entry
connection-mark ( read-only: text ) - Connection mark set in mangle
dst-address ( read-only: IP address | port ) - the destination address and port the connection is
established to
icmp-id ( read-only: integer ) - contains the ICMP ID. Each ICMP packet gets an ID set to it when
it is sent, and when the receiver gets the ICMP message, it sets the same ID within the new ICMP
message so that the sender will recognize the reply and will be able to connect it with the
appropriate ICMP request
icmp-option ( read-only: integer ) - the ICMP type and code fields
p2p ( read-only: text ) - peer to peer protocol
protocol ( read-only: text ) - IP protocol name or number
reply-dst-address ( read-only: IP address | port ) - the destination address and port the reply
connection is established to
reply-icmp-id ( read-only: integer ) - contains the ICMP ID of received packet
reply-icmp-option ( read-only: integer ) - the ICMP type and code fields of received packet
reply-src-address ( read-only: IP address | port ) - the source address and port the reply
connection is established from
Page 469 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
