1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["1836"],{51409:function(e,n,t){t.r(n),t.d(n,{frontMatter:()=>c,toc:()=>l,default:()=>h,metadata:()=>o,assets:()=>s,contentTitle:()=>a});var o=JSON.parse('{"id":"reference/host-endpoints/conntrack","title":"Connection tracking","description":"Workaround for Linux conntrack if Calico policy is not working as it should.","source":"@site/calico_versioned_docs/version-3.28/reference/host-endpoints/conntrack.mdx","sourceDirName":"reference/host-endpoints","slug":"/reference/host-endpoints/conntrack","permalink":"/calico/3.28/reference/host-endpoints/conntrack","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/reference/host-endpoints/conntrack.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Workaround for Linux conntrack if Calico policy is not working as it should."},"sidebar":"calicoSidebar","previous":{"title":"Summary of host endpoint policies","permalink":"/calico/3.28/reference/host-endpoints/summary"},"next":{"title":"Architecture","permalink":"/calico/3.28/reference/architecture/"}}'),r=t(37937),i=t(17869);let c={description:"Workaround for Linux conntrack if Calico policy is not working as it should."},a="Connection tracking",s={},l=[];function d(e){let n={code:"code",h1:"h1",header:"header",li:"li",p:"p",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"connection-tracking",children:"Connection tracking"})}),"\n",(0,r.jsx)(n.p,{children:"Calico uses Linux's connection tracking ('conntrack') as an important\noptimization to its processing. It generally means that Calico only needs to\ncheck its policies for the first packet in an allowed flow\u2014between a pair of\nIP addresses and ports\u2014and then conntrack automatically allows further\npackets in the same flow, without Calico rechecking every packet."}),"\n",(0,r.jsx)(n.p,{children:"This can, however, make it look like a Calico policy is not working as it\nshould, if policy is changed to disallow a flow that was previously allowed.\nIf packets were recently exchanged on the previously allowed flow, and so there\nis conntrack state for that flow that has not yet expired, that conntrack state\nwill allow further packets between the same IP addresses and ports, even after\nthe Calico policy has been changed."}),"\n",(0,r.jsx)(n.p,{children:"Per Calico's current implementation, there are two workarounds for this:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Somehow ensure that no further packets flow between the relevant IP\naddresses and ports until the conntrack state has expired (typically about\na minute)."}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Use the 'conntrack' tool to delete the relevant conntrack state; for example\n",(0,r.jsx)(n.code,{children:"conntrack -D -p tcp --orig-port-dst 80"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Then you should observe that the new Calico policy is enforced for new packets."})]})}function h(e={}){let{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},17869:function(e,n,t){t.d(n,{R:()=>c,x:()=>a});var o=t(82645);let r={},i=o.createContext(r);function c(e){let n=o.useContext(i);return o.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),o.createElement(i.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.