A blazingly fast, Rust-based TUI connection monitor for OpenWrt, specializing in MediaTek Hardware Offloading (PPE & WED) analytics.
Conntracktor is a lightweight Terminal User Interface (TUI) utility designed for modern OpenWrt routers. While standard tools like top only show CPU usage, they completely miss the massive amount of traffic being processed by hardware accelerators. Conntracktor looks under the hood of netfilter to show you exactly what connections are active, where they are coming from, and whether they are bypassing the CPU via hardware offloading.
Compatibility: Developed and thoroughly tested on the MediaTek MT7981 (Filogic 820), with full dynamic support for the broader MediaTek family via Device Tree detection:
Filogic (modern ARM):
- MT7988 (Filogic 880, Wi-Fi 7)
- MT7987 (Filogic 850, Wi-Fi 7 entry)
- MT7986 (Filogic 830, Wi-Fi 6/6E)
- MT7981 (Filogic 820, Wi-Fi 6)
- MT7622 (Filogic 800, Wi-Fi 6 / early ARM)
Legacy:
- MT7629 (Wi-Fi 5)
- MT7621 (Wi-Fi 5 / MIPS)
- MT7628 (Wi-Fi 4/5 budget)
- MT7620 (Wi-Fi 4/5 budget)
It also gracefully falls back to standard software metrics on any generic OpenWrt device supporting nf_conntrack.
- Real-time Connection Tracking: View total active vs. maximum allowed connections.
- Smart Traffic Classification: Automatically categorizes active sessions into:
- 🖧 Router (Local): Traffic generated by the router itself (e.g., NTP, OPKG/APK).
- 🖥️ Wired: LAN client connections.
- 📶 Wi-Fi: Wireless client connections.
- 🛡️ VPN: Virtual Private Network endpoints (WireGuard, OpenVPN, Tailscale).
- 🌐 Remote: Public Internet addresses.
- 📢 Multicast: Multicast and broadcast traffic (e.g., IPTV, mDNS, IGMP, OSPF).
- ❓ Unknown: Uncategorized private subnets or ISP management equipment.
- Hardware Offload Analytics:
- Tracks connections accelerated by the PPE (Packet Processing Engine), indicated by
[HW_OFFLOAD]. - Infers WED (Wireless Ethernet Dispatcher) usage by correlating hardware-offloaded sessions with wireless interfaces.
- Tracks connections accelerated by the PPE (Packet Processing Engine), indicated by
- Dynamic SoC Adaptation: Automatically detects your router's chipset via the Linux Device Tree to adjust the layout and accurately report on all available PPE/WED engines.
- Zero Disk I/O: Specifically designed for routers with slow or restricted eMMC storage. All data is parsed directly from RAM (
/procand/sys), and the binary runs flawlessly fromtmpfs. - Low CPU Footprint: Written in safe, compiled Rust with a highly optimized render loop.
Main interface
┌ 🚜 Conntracktor v0.1.0 ──────────────────────────────────────── [ press ? for help ] ┐
│ OpenWrt │ OpenWrt 25.12-snapshot │ Uptime: 2d 12h │ CPU: 2% │ RAM: 370/986 MB │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌ Active Connections [ 544 / 63488 ] ─────────────────────[CPU: 510] [SW: 7] [PPE: 27] ┐
│ PROTO SOURCE IP DESTINATION IP STATUS OFFLOAD │
│ │
│>> UDP 🖧 168.27.134.47 🌐 221.298.97.183 CPU │
│ UDP 🖧 168.27.134.47 🌐 5.79.78.211 CPU │
│ UDP 📶 192.168.1.30 📶 192.168.1.116 CPU │
│ TCP 🌐 18.146.193.61 🖧 168.27.134.47 ESTABLISHED CPU │
│ UDP 🌐 37.16.72.197 🖧 168.27.134.47 CPU │
│ UDP 🌐 142.51.63.179 🖧 168.27.134.47 CPU │
│ UDP 🌐 65.38.65.161 🖧 168.27.134.47 CPU │
│ UDP 🌐 16.119.112.248 🖧 168.27.134.47 CPU │
│ TCP 📶 192.168.1.96 🌐 87.58.147.204 dst=87.58.147.2 HW (PPE) │
│ UDP 📶 192.168.1.116 📶 192.168.1.30 SOFTWARE │
│ UDP 🌐 185.168.238.27 🖧 168.27.134.47 CPU │
│ UDP 🌐 54.32.177.27 🖧 168.27.134.47 CPU │
│ UDP 🌐 14.135.142.7 🖧 168.27.134.47 CPU │
└──────────────────────────────────────────────────────────────────────────────────────┘
Other panels
┌─ Hardware ────────────────────── [ Hardware support only. Software may be disabled ] ┐
│ SoC MediaTek MT7986AV (Filogic 830) │
│ CPU 2× Cortex-A53 @ 1300 MHz │
│ Memory 1 GB DDR4 @ 3200 MT/s │
│ Switch Airoha AN8855 @ 2.5G Gbps │
│ Flash FORESEE F35SQA001G (eMMC) │
│ Misc USB 3.2 Gen1 (5G) │
│ │
│ Networking Security │
│ PPE ✓ Crypto Engine ✓ │
│ WED ✓ AES ✓ │
│ RSS ✗ SHA ✓ │
│ Checksum Offload ✓ TRNG ✓ │
│ TSO ✓ Secure Boot ✓ │
│ Multi RX Queues ✗ TrustZone (TEE) ✓ │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Packet Pipeline ────────────────────────────────────────────────────────────────────┐
│ Hardware offload: │
│ PPE: ✓ enabled (1 table) │
│ WED: ✓ enabled (2.4GHz, 5GHz) │
│ │
│ Software processing: │
│ RPS: ✓ enabled → CPU1 │
│ XPS: ✗ disabled │
│ Flow table: ✗ disabled │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Network Queues ─────────────────────────────────────────────────────────────────────┐
│ eth0 │
│ RX queues: 1 │
│ rx-0 RPS: CPU1 │
│ │
│ TX queues: 16 │
│ │
│ DMA: RX rings: 1 TX rings: 16 │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Interrupts ─────────────────────────────────────────────────────────────────────────┐
│ Device IRQ CPU0 CPU1 │
│ │
│ Ethernet 75,76 7.9M 0 │
│ WiFi 73 39.6M 0 │
│ MMC 78 0.2M 0 │
│ USB 0 0 │
│ │
│ IRQ affinity: concentrated on CPU0 ⚠ │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ SoftIRQ ────────────────────────────────────────────────────────────────────────────┐
│ NET_RX NET_TX │
│ CPU0 6.2M 5.3M │
│ CPU1 4.7M 9.2M │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Packet Processing ──────────────────────────────────────────────────────────────────┐
│ RSS: OFF (RX queues: 1) │
│ RPS: ON │
│ RPS CPUs: CPU1 │
│ RPS flow table: OFF │
│ XPS: OFF │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Hardware Offload ───────────────────────────────────────────────────────────────────┐
│ PPE0: 15234/32768 [█████████░░░] WED0(2.4G): 512/2048 [█████████████░░░] │
│ PPE1: 28192/32768 [████████░░░░] WED1(5G): 1892/2048 [███████████░░░░░] │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Software Fast Path ─────────────────────────────────────────────────────────────────┐
│ Backend: nftables │
│ Status: enabled ✓ │
│ │
│ Tables: 1 │
│ Flows: 150 / 4096 │
│ │
│ Devices: │
│ eth0 ✓ │
│ br-lan ✓ │
└──────────────────────────────────────────────────────────────────────────────────────┘
┌─ Help ───────────────────────────────────────────────────────────────────────────────┐
│ │
│ Navigation │
│ ↑ ↓ / j k Move selection │
│ Enter Expand selected │
│ Space │
│ Tab │
│ │
│ Panels │
│ 1 Hardware │
│ 2 Packet Pipeline │
│ 3 Network Queues │
│ 4 Interrupts │
│ 5 SoftIRQ │
│ 6 Packet Processing │
│ 7 Hardware Offload │
│ 8 Software Fast Path │
│ │
│ Actions │
│ r Refresh │
│ p Pause updates │
│ e Export diagnostics │
│ ? Toggle help │
│ q Quit │
│ │
└──────────────────────────────────────────────────────────────────────────────────────┘
Modern MediaTek Filogic (MT798x) SoCs include two independent hardware acceleration engines that dramatically reduce CPU utilization during packet forwarding. Although they are often mentioned together, PPE and WED solve different problems and operate independently.
The Packet Processing Engine (PPE) is a dedicated hardware accelerator responsible for forwarding established network flows without traversing the full Linux networking stack.
After the first packets of a connection are processed by the kernel (connection tracking, firewall, NAT, routing, etc.), compatible flows can be offloaded into the PPE through Linux nftables flowtables. Once offloaded, subsequent packets are forwarded almost entirely in hardware.
PPE accelerates:
- IPv4 routing
- NAT
- PPPoE
- VLAN forwarding
- Checksum calculation
- Long-lived TCP/UDP flows
In addition, the hardware is capable of supporting:
- bridge forwarding
- multicast forwarding
- hardware flow aging
- packet classification
- ACLs
- QoS/traffic prioritization
Support for these advanced capabilities depends on the Linux driver and OpenWrt implementation.
The Wireless Ethernet Dispatcher (WED) is a dedicated accelerator for the Wi-Fi data path.
Unlike the PPE, WED does not perform routing, NAT, firewalling or packet inspection. Its only responsibility is to accelerate packet movement between the Wi-Fi subsystem, DMA engines and the rest of the networking pipeline.
WED improves performance by:
- reducing interrupt frequency
- managing RX/TX DMA rings
- accelerating descriptor processing
- recycling packet buffers
- optimizing DMA queue handling
- improving burst traffic handling
- reducing CPU cache pressure
The result is significantly lower CPU utilization while maintaining high Wi-Fi throughput.
Although completely independent hardware blocks, PPE and WED complement each other.
For Wi-Fi to Ethernet traffic:
- WED accelerates packet movement inside the wireless subsystem.
- Linux processes only the first packets required to establish a flow.
- The flow is installed into the PPE.
- All subsequent packets bypass most of the Linux networking stack.
This architecture enables MediaTek Filogic routers to sustain near wire-speed routing while keeping CPU utilization extremely low.
Since routers run on specific architectures (like ARM64 for MediaTek MT7981B) and use musl-libc, the easiest way to compile Conntracktor is using cross.
Install Rust and cross on your development machine:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
cargo install crossgit clone https://github.com/yourusername/conntracktor.git
cd conntracktor
# Cross-compile for aarch64 with musl (MT7981 / Filogic 820)
cross build --target aarch64-unknown-linux-musl --release/tmp (which is tmpfs / RAM).
# Copy the compiled binary to the router's RAM
scp target/aarch64-unknown-linux-musl/release/conntracktor root@192.168.1.1:/tmp/
# SSH into the router and run the monitor
ssh root@192.168.1.1
/tmp/conntracktorCurrently, Conntracktor auto-detects ethX, lanX for wired connections and wlanX, phyX for wireless interfaces. If you have custom interface names (e.g., VLANs, WireGuard), you can map them in an optional config file or via CLI arguments (coming in v0.2).
This project is licensed under the MIT License - see the LICENSE file for details.