Who rated this post

It is not nice when the "fw ctl conntab" is displayed in an unformatted format. In this way, one always searches for the correct connections with the parameters in the output. I have created a nice overview "sorted by rule numbers". An easy connection table version:-)

When you execute this oneliner, a new cli command "econntab" is created:

cat <<EOT > /usr/bin/econntab
printf '%.s-' {1..132};echo -e "\nRule         Proto            Source IP         S-Port   Destination IP          D-Port            Timeout                     State";printf '%.s-' {1..132};fw ctl conntab | awk '{print \$6 " "\$2 \$3 \$4 " "\$5 " "\$8}' | sed -e 's/src=//g' | sed -e 's/\],dest=\[/ /g' | sed -e 's/\],/ /g' | sed -e 's/)\;//g' | sed -e 's/\[//g'  | sed -e 's/rule\=/ /g' | sed -e 's/\,/ /g' | sed -e 's/state\=/ /g' | sed -e 's/Ifn[c,s]in\=[0-9]*//g' | sed -e 's/Ifn[c,s]out\=[0-9]*//g' | awk '{printf "%.6s \t%10s \t%15s \t%6s \t%15s \t%7s \t%10s \t%20s \n", \$1, \$6, \$2, \$3 ,\$4, \$5, \$7 ,\$8}' 2>&1 | sort -n | uniq
EOT
chmod 770 /usr/bin/econntab

After that, you only need to execute the following cli command in expert mode:

# econntab

With grep you can search for many interesting parameters of the connection table:

# econntab | grep SYN_SENT                                                            --> connections that have only sent one TCP SYN packet
# econntab | grep FIN                                                                         --> connections that are in the process of being disconnected
# econntab | grep ^'61'                                                                       --> for example all connections of the rule 61
# econntab | grep 1.1.1.1                                                                    --> all connections for IP 1.1.1.1
# econntab | grep ICPM                                                                      --> all ICPM connections
# econntab | grep ' 443 ' | grep "SYN"                                              --> all https connections in "SYN" state
# econntab | grep ' [0-9]/'                                                                  --> all connections that time out in the next 10 seconds
# econntab | grep -E '^[1-9][0-9][0-9][0-9][0-9][0-9]'                   --> all implied rules
# econntab | grep -v -E '^[1-9][0-9][0-9][0-9][0-9][0-9]'               --> all without implied rules
# econntab | grep '00000070'                                                             --> VRRP connections
# econntab | grep '0000002f'                                                             --> GRE connections

PS:
If you see rules >100000, this is not an error, but it is an implied rule.