Octet

Say this first

conntrack is the kernel's connection tracking table. It records every flow as a pair of tuples, original and reply, and it is what makes stateful filtering and NAT possible. NEW is the first packet of a flow. ESTABLISHED means traffic has been seen in both directions. RELATED is a new flow tied to an existing one, such as an ICMP error or FTP data with a helper. INVALID is a packet that fits no known flow, like a TCP segment far outside the window. UNTRACKED is traffic exempted in the raw table.

Go deeper

Reading the table

Output

$ sudo conntrack -L -p tcp --dport 443
tcp      6 431997 ESTABLISHED src=10.20.0.15 dst=198.51.100.80 sport=40112 dport=443 src=198.51.100.80 dst=203.0.113.10 sport=443 dport=40112 [ASSURED] mark=0 use=1
tcp      6 117 SYN_SENT src=10.20.0.16 dst=198.51.100.81 sport=52210 dport=443 [UNREPLIED] src=198.51.100.81 dst=203.0.113.10 sport=443 dport=52210 mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.

6 is the protocol number, then the seconds left before the entry expires.
ESTABLISHED, SYN_SENT are conntrack's internal TCP states, more detailed than the firewall view.
The first tuple is the original direction, the second the expected reply. A different reply destination (203.0.113.10) means the flow is source NATed.
[UNREPLIED]: nothing came back yet. [ASSURED]: seen both ways, will not be evicted early.

Default timeouts worth knowing

TCP established 432000 seconds (5 days), TCP SYN_SENT 120 seconds, a UDP flow that has seen one packet 30 seconds; UDP flows with traffic both ways get a longer "stream" timeout. They are sysctls named net.netfilter.nf_conntrack_<protocol>_timeout....

Firewall view

Shell

iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
nft add rule inet filter forward ct state established,related accept

UDP and ICMP have no connections, but conntrack still gives them states: a DNS reply is ESTABLISHED because a matching query went out.

They will ask next

Can a TCP packet without SYN be NEW?
Yes. By default (nf_conntrack_tcp_loose=1) conntrack picks up flows mid-stream, for example after a firewall restart. If you want only SYNs to open flows, match --syn or tcp flags syn with ct state new.
Why does active FTP or SIP not work through a Linux NAT by default?
Their control channel carries addresses and ports for a second flow. A conntrack helper reads that and creates the RELATED expectation. Since kernel 4.7 helpers are no longer assigned automatically; you attach them explicitly with the CT --helper target or an nft ct helper object.

Traps

Confusing conntrack's TCP state (SYN_SENT, TIME_WAIT) with the firewall state (NEW, ESTABLISHED).
Forgetting that conntrack keeps old NAT mappings after rule changes.

How did you do?