Hi Florian Further to our investigation, I have identified the cause of confusion: # conntrack -C 141412 # conntrack -L >/dev/null conntrack v1.4.4 (conntrack-tools): 8342 flow entries have been shown. # conntrack -f ipv6 -L >/dev/null conntrack v1.4.4 (conntrack-tools): 124358 flow entries have been shown. so -C option implicitly sums up ipv4 and ipv6 counts, and -L option defaults to ipv4. This is neither a consistent UX practice nor properly documented. I am happy to bring it up - Christmas present xD
