I have a Netlink socket, subscribed to destroy events, by using bind with NF_NETLINK_CONNTRACK_DESTROY OR'd into the groups parameter.

When looking through the nfnetlink_compat.h, though, I see that there're more flags than just NEW, UPDATE, and DESTROY - there's an EXP_XYZ variant for each flag as well:

#define NF_NETLINK_CONNTRACK_NEW            0x00000001
#define NF_NETLINK_CONNTRACK_UPDATE         0x00000002
#define NF_NETLINK_CONNTRACK_DESTROY        0x00000004
#define NF_NETLINK_CONNTRACK_EXP_NEW        0x00000008
#define NF_NETLINK_CONNTRACK_EXP_UPDATE     0x00000010

I can't find the EXP_XYZ flags documented anywhere I've looked. Where can I find more information on these flags?

1 Answer 1


These flags exist to handle notifications about conntrack expectations, which are conntrack RELATED states that are stored in a table and handled by the kernel; you can be notified if an expectation is being added, deleted or modified. This table can be manipulated by user programs like conntrack-tools toolset but are used by kernel modules like the FTP and SIP helpers.

That said, I've never had to use this feature directly: it's usually handled automatically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.