nf_ct_resolve_clash_harder(9)

💅 nf_ct_resolve_clash_harder(9) — like, the Kernel API Manual one, bestie 🎀

okay so this is nf_ct_resolve_clash_harder from the Kernel API Manual (nf_ct_resolve_clash_harder(9), yes the title and the manual name are literally the same thing, we love a consistent queen ✨). sit down, grab a strawberry drink 🍓, and let's get into it.

---

🌸 NAME 🌸

nf_ct_resolve_clash_harder — bestie's whole job is attempting to insert a clashing conntrack entry 💅

---

🦋 SYNOPSIS 🦋

int nf_ct_resolve_clash_harder (struct sk_buff *skb , u32 repl_idx );

that's it. that's the signature. copy it exactly, no cap, or the compiler will simply end you 😭

---

✨ ARGUMENTS ✨

• skb — the skb that causes the collision 💀 like, this is the packet that started all the drama.
• repl_idx — the hash slot for the reply direction 🎀 that's the little address where the reply side lives.

---

👑 DESCRIPTION 👑

so the way this works is: this function gets called when the origin direction or the reply direction had a clash 🔥

and here's the good news — the skb can still be handled without packet drop, provided that either the reply direction is unique ✨, or the existing entry has the identical tuple in both directions 🫶. iykyk.

⚠️ real talk though: the caller must hold conntrack table locks to prevent concurrent updates. not optional. not a vibe. hold the locks fr fr 🔒

it returns NF_DROP if the clash could not be handled 😭 so like, if it couldn't sort it out, the packet's getting dropped, periodt.

---

🌈 SEE ALSO 🌈

• the kernel file ./net/netfilter/nf_conntrack_core.c 📁 (yes, go read the source, main character energy)
• nf_ct_match_reverse(9)
• nf_ct_resolve_clash(9)
• nf_ct_iterate_destroy(9)

all of these are linked, all of these matter, don't skip them 💜

---

mwah 💋 that's the whole page. sourced from ./net/netfilter, dated October 2026 — go off, kernel docs, you ate 👑✨