Conntrack turns a blind eye to dropped SYNs

This post delves into the intricacies of the Linux kernel's conntrack module and its interaction with the Netfilter framework. It explains why conntrack doesn't log dropped SYN packets by default, how to enable its hooks, and uses BPF tracing to demonstrate the flow of packets through Netfilter. This contributes to the understanding of data infrastructure by providing a deep dive into a fundamental network component that impacts traffic analysis and observability.