  <varlistentry>
  <term><emphasis remap='B'>sareftrack</emphasis></term>
  <listitem>
<para>Set the method of tracking reply packets with SArefs when using an
SAref compatible stack. Currently only the <emphasis remap='I'>mast</emphasis>
stack supports this.  Acceptable values are <emphasis remap='B'>yes</emphasis>
(the default), <emphasis remap='B'>no</emphasis> or <emphasis remap='B'>conntrack</emphasis>. This option is ignored when SArefs are not supported. This option
is passed as PLUTO_SAREF_TRACKING to the <emphasis remap='I'>updown</emphasis>
script which makes the actual decisions whether to perform any iptables/ip_conntrack
manipulation. A value of yes means that an IPSEC mangle table will be created. This table
will be used to match reply packets. A value of conntrack means that
additionally, subsequent packets using this connection will be marked as
well, reducing the lookups needed to find the proper SAref by using the
ip_conntrack state. A value of no means no IPSEC mangle table is created,
and SAref tracking is left to a third-party (kernel) module. In case of a third
party module, the SArefs can be relayed using the <emphasis remap='I'>statsbin=</emphasis> notification helper.
</para>
  </listitem>
  </varlistentry>

