Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for hardening purposes.

How to disable conntrack protocol parsing in the linux kernel?

  • 1
    As long as none of your iptables uses a RELATED, it shouldn't parse the protocol.
    – Ángel
    Apr 25, 2016 at 21:02
  • If you disable connection tracking helpers how are you going to handle protocols like FTP?
    – Daisetsu
    Apr 25, 2016 at 21:07
  • @Ángel that only handles one of the two issues mentioned. Not using RELATED doesn't mitigate the second issue, "where the parser has a bug which is exploitable".
    – sourcejedi
    Dec 25, 2018 at 18:50

2 Answers 2


There are a few ways to set module parameters, both temporary and persistent. The previous answer provides only a temporary change which furthermore does not work if the module is already loaded.

Persistent changes

The change will take effect as soon as the module is loaded, whether it is done manually or automatically at boot. If the module is already loaded, you must either reboot, or load it and unload it, which may or may not be possible if it has unremovable dependencies. To do this, create a file, such as /etc/modprobe.d/no_conntrack_helper.conf, with the following contents:

options nf_conntrack nf_conntrack_helper=0

Temporary changes (modprobe)

This requires the module be unloaded before you run the command. The changes will disappear when the module is unloaded or when the system reboots. You can change specific parameters by passing them as arguments to the modprobe utility when loading the module. Load the module as root:

modprobe nf_conntrack nf_conntrack_helper=0

Temporary changes (sysfs)

Some modules can have their parameters modified even after the module has been loaded. This can be done by writing to a special file in sysfs. I do not know if the specific parameter you want to change can be modified at runtime, but if it can, you would want to run the following command as root:

echo 0 > /sys/module/nf_conntrack/parameters/nf_conntrack_helper

You can disable the module.

modprobe nf_conntrack nf_conntrack_helper=0

More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/

  • This has to be done before it's loaded obviously
    – Daisetsu
    Apr 25, 2016 at 21:13
  • This isn't really an answer, considering this would cause a one-time change.
    – forest
    Feb 1, 2018 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .