nf_ct_resolve_clash(9)

✨ NAME ✨

okay so bestie, welcome to nf_ct_resolve_clash(9) from the Kernel API Manual 💖 — short version: nf_ct_resolve_clash is here to attempt to handle clash without packet drop. that's the whole assignment, no cap.

🦋 SYNOPSIS 🦋

       __cold int nf_ct_resolve_clash (struct sk_buff *skb , struct
       nf_conntrack_tuple_hash *h , u32 reply_hash );

🎀 ARGUMENTS 🎀

• skb — the skb that causes the clash. yup, this one is the drama source 💀
• h — tuplehash of the clashing entry already in table. it's the existing entry we're bumping into 🫶
• reply_hash — hash slot for reply direction. ✨

🔥 DESCRIPTION 🔥

okay so picture this: a conntrack entry can be inserted to the connection tracking table if there is no existing entry with an identical tuple. easy enough. ✨

But if there is one? then skb (and the associated, unconfirmed conntrack) has to be dropped. 😭 And in case skb is retransmitted, next conntrack lookup will find the already-existing entry. so the packet loss is real.

The major problem with such packet drop is the extra delay added by the packet loss -- it will take some time for a retransmit to occur (or the sender to time out when waiting for a reply). literally the worst vibe. 💀

This function attempts to handle the situation without packet drop. main character energy fr fr. 👑

If skb has no NAT transformation or if the colliding entries are exactly the same, only the to-be-confirmed conntrack entry is discarded and skb is associated with the conntrack entry already in the table. slay, no drop. 💅

Failing that, the new, unconfirmed conntrack is still added to the table provided that the collision only occurs in the ORIGINAL direction. The new entry will be added only in the non-clashing REPLY direction, so packets in the ORIGINAL direction will continue to match the existing entry. The new entry will also have a fixed timeout so it expires -- due to the collision, it will only see reply traffic. ⏳

Returns NF_DROP if the clash could not be resolved. that's the final boss outcome, bestie. 😤

🌈 SEE ALSO 🌈

• Kernel file ./net/netfilter/nf_conntrack_core.c — the source vibe 🧚
• nf_ct_match_reverse(9)
• nf_ct_resolve_clash_harder(9)
• nf_ct_iterate_destroy(9)

catch u later, bestie — source/version: ./net/netfilter, date: October 2026, and the page is nf_ct_resolve_clash(9). hugs and kisses 💖🫶🎀