A good addition to your conntrack-tools package. Conntracker acts like a firewall sniffer, it analysis, realtime, with very low overhead, all iptables (or nf_tables) existing flows and inform you, at the very end of its execution, all flows in a sorted and consumable way.