Conntrack when combined with connection tracking, allows access to the connection tracking state for this packet/connection.

Ctstate expects at least one state is necessary, so that's the reason for split of parameters.

Destination will generate arguments for the "-d, --destination address[/mask]" flag See the description of the -s (source) flag for a detailed description of the syntax ref.

Gid Matches if the packet socket's file structure is owned by the given group.

InInterface will generate arguments for the "-i, --in-interface name" flag Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains).

OutInterface will generate arguments for the "-o, --out-interface name" flag Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains).

Owner attempts to match various characteristics of the packet creator,for locally generated packets.

Source will generate arguments for the "-s, --source address[/mask]" flag Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address.

Uid matches if the packet socket's file structure (if it has one) is owned by the user with given UID.

UidRangeOrValue matches if the packet socket's file structure (if it has one) is owned by the user with given list of UID values or ranges.