**Summary**
It would be beneficial if, from an op-mode command, we could get data for:
- Counters per connection/flow
- Counters and filter based on VRFs.
**Use case**
Example where this VRF and interfaces are configured:
```
vyos@vyos:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- ---------------------- ----------------- ------- ----- ----- -------------
eth0 192.168.77.18/24 50:00:00:01:00:00 FOO 1500 u/u
eth1 - 50:00:00:01:00:03 default 1500 u/u
eth2 10.10.10.1/24 50:00:00:01:00:02 FOO 1500 u/u
lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
::1/128
vyos@vyos:~$
vyos@vyos:~$ show configuration commands | grep vrf
set interfaces ethernet eth0 vrf 'FOO'
set interfaces ethernet eth2 vrf 'FOO'
set vrf bind-to-all
set vrf name BAR table '120'
set vrf name FOO table '110'
vyos@vyos:~$
```
While troubleshooting and analyzing traffic through VyOS router, in some cases it is useful to:
1. Print conntrack table, but with corresponding counters per connection.
2. While working on a multi-VRF setup, it would be good to filter the output of the conntrack table, based on VRF.
**Additional information**
**//Counter per flow//**
What is needed?
1. Enable conntrack counters - Already covered by set system conntrack flow-accounting
2. Now we can see the counter while working directly with sudo conntrack -L -o extended
```
vyos@vyos# sudo conntrack -L -o extended -p icmp
ipv4 2 icmp 1 29 src=10.10.10.2 dst=142.251.128.132 type=8 code=0 id=3348 zone-orig=110 packets=9 bytes=756 src=142.251.128.132 dst=10.10.10.2 type=0 code=0 id=3348 packets=9 bytes=756 mark=0 use=1
vyos@vyos:~$ sudo conntrack -L -o extended -p tcp
ipv4 2 tcp 6 116 TIME_WAIT src=10.10.10.2 dst=142.251.128.132 sport=48730 dport=443 zone-orig=110 packets=17 bytes=1707 src=142.251.128.132 dst=10.10.10.2 sport=443 dport=48730 packets=26 bytes=24159 [ASSURED] mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
vyos@vyos:~$
```
3. Ideally, take that information and add a column for `show conntrack table ipvX` command. Current layout:
```
vyos@vyos:~$ show conntrack table ipv4
Id Original src Original dst Reply src Reply dst Protocol State Timeout Mark Zone
---------- ------------------- --------------------- --------------------- ------------------- ---------- --------- --------- ------ ------
1160509145 192.168.77.11:44740 255.255.255.255:29810 255.255.255.255:29810 192.168.77.11:44740 udp 14 0
1070081648 192.168.77.21:40865 255.255.255.255:29810 255.255.255.255:29810 192.168.77.21:40865 udp 23 0
3752972353 192.168.77.10:50482 255.255.255.255:29810 255.255.255.255:29810 192.168.77.10:50482 udp 26 0
885834930 192.168.77.11:35402 255.255.255.255:29810 255.255.255.255:29810 192.168.77.11:35402 udp 24 0
2861055694 192.168.77.24:55466 255.255.255.255:29810 255.255.255.255:29810 192.168.77.24:55466 udp 26 0
2840884512 192.168.77.13:45261 255.255.255.255:1900 255.255.255.255:1900 192.168.77.13:45261 udp 14 0
3567118868 0.0.0.0:68 255.255.255.255:67 255.255.255.255:67 0.0.0.0:68 udp 15 0
4000514580 10.10.10.2:48730 142.251.128.132:443 142.251.128.132:443 10.10.10.2:48730 tcp TIME_WAIT 81 0
3074099977 192.168.77.1:5678 255.255.255.255:5678 255.255.255.255:5678 192.168.77.1:5678 udp 16 0
vyos@vyos:~$
```
**//Filter based on VRF//**
As exposed before, we can see an option 'zone-orig=110', which indicates traffic from VRF FOO, as shown next
```
vyos@vyos:~$ sudo nft list table inet vrf_zones
table inet vrf_zones {
map ct_iface_map {
typeof iifname : ct zone
elements = { "FOO" : 110,
"BAR" : 120,
"eth0" : 110,
"eth2" : 110 }
}
chain vrf_zones_ct_in {
type filter hook prerouting priority raw; policy accept;
counter packets 3808 bytes 834192 ct original zone set iifname map @ct_iface_map
}
chain vrf_zones_ct_out {
type filter hook output priority raw; policy accept;
counter packets 85 bytes 8472 ct original zone set oifname map @ct_iface_map
}
}
```
So, we can even use that field for filtering the output of conntrack:
```
vyos@vyos:~$ sudo conntrack -L -o extended --orig-zone 110
ipv4 2 udp 17 17 src=192.168.77.24 dst=255.255.255.255 sport=42365 dport=29810 zone-orig=110 packets=1 bytes=879 [UNREPLIED] src=255.255.255.255 dst=192.168.77.24 sport=29810 dport=42365 packets=0 bytes=0 mark=0 use=1
ipv4 2 udp 17 4 src=192.168.77.24 dst=255.255.255.255 sport=55466 dport=29810 zone-orig=110 packets=24 bytes=21096 [UNREPLIED] src=255.255.255.255 dst=192.168.77.24 sport=29810 dport=55466 packets=0 bytes=0 mark=0 use=1
ipv4 2 udp 17 25 src=192.168.77.11 dst=255.255.255.255 sport=37410 dport=29810 zone-orig=110 packets=4 bytes=3412 [UNREPLIED] src=255.255.255.255 dst=192.168.77.11 sport=29810 dport=37410 packets=0 bytes=0 mark=0 use=1
ipv4 2 udp 17 27 src=192.168.77.10 dst=255.255.255.255 sport=45990 dport=29810 zone-orig=110 packets=21 bytes=17904 [UNREPLIED] src=255.255.255.255 dst=192.168.77.10 sport=29810 dport=45990 packets=0 bytes=0 mark=0 use=1
ipv4 2 udp 17 24 src=192.168.77.21 dst=255.255.255.255 sport=55593 dport=29810 zone-orig=110 packets=22 bytes=10230 [UNREPLIED] src=255.255.255.255 dst=192.168.77.21 sport=29810 dport=55593 packets=0 bytes=0 mark=0 use=1
ipv4 2 udp 17 14 src=192.168.77.1 dst=255.255.255.255 sport=5678 dport=5678 zone-orig=110 packets=2 bytes=408 [UNREPLIED] src=255.255.255.255 dst=192.168.77.1 sport=5678 dport=5678 packets=0 bytes=0 mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 6 flow entries have been shown.
```