The state table entry has 19 seconds until it expires. Source and destination addresses and ports of original query. Source and destination addresses and ports of expected reply. If multiple requests and replies occur between the same socket pairs, the entry is considered to be a stream and the timeout changes to 180 seconds. TCP A tcp connection is initiated via a three-way handshake involving a synchronization request from the client, a synchronization and an acknowledgement from the server, and finally an acknowledgement from the client.
Subsequent traffic flowing between server and client is acknowledged in all cases.
SYN and ACK refer to flags set in the tcp header. There are also 32 bit sequence and acknowledgement numbers stored in the tcp header which are passed back and forth and updated during the session. When it arrives, we check that it's sequence number matches the ACK of the handshake from the server to the client. We just talked a lot about tcp connection states. The important point here is that the conntrack states are not equivalent to tcp states .