TC CONNTRACK SEQUENCES(9)

💅 TC conntrack sequences

okay so bestie, welcome to the TC conntrack sequences(9) page in the Kernel API Manual — this is the conntrack-sequences explainer, and the MAE hardware is absolutely the main character here, so let’s get into it 💅

The MAE hardware can handle at most two rounds of action rule matching. Consequently, we support conntrack through the notion of a "left-hand side rule". This is a rule which typically contains only the actions ct and goto chain N, and corresponds to one or more "right-hand side rules" in chain N, which typically match on +trk+est, and may perform ct(nat) actions. it’s giving paired-rule choreography, fr fr 🫶

RHS rules go in the Action Rule table as normal but with a nonzero recirc_id (the hardware equivalent of chain_index), while LHS rules may go in either the Action Rule or the Outer Rule table, the latter being preferred for performance reasons, and set both DO_CT and a recirc_id in their response. highkey an important little table-placement moment ✨

Besides the RHS rules, there are often also similar rules matching on +trk+new which perform the ct(commit) action. These are not offloaded. no cap, that’s the whole note 🎀

🌸 SEE ALSO

• Kernel file ./drivers/net/ethernet/sfc/tc.c — struct efx_tc_mangler_state(9), efx_tc_mangle(9), efx_tc_incomplete_mangle(9)

cute little sign-off: source/version is ./drivers/net/ethernet/sfc, the date is October 2026, and this whole vibe is literally TC conntrack sequences(9) — slay, bye bestie 💖✨