[pve-devel] [PATCH docs v3 14/14] qm: document conntrack state migration for live migrations

From: Christoph Heiss <c.heiss@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH docs v3 14/14] qm: document conntrack state migration for live migrations
Date: Thu,  3 Jul 2025 13:54:16 +0200	[thread overview]
Message-ID: <20250703115621.883244-15-c.heiss@proxmox.com> (raw)
In-Reply-To: <20250703115621.883244-1-c.heiss@proxmox.com>

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Changes v2 -> v3:
  * new patch

 qm.adoc | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/qm.adoc b/qm.adoc
index 8b9e096..823e818 100644
--- a/qm.adoc
+++ b/qm.adoc
@@ -1664,6 +1664,22 @@ For Live Migration to work, there are some things required:
   configured, but it cannot be guaranteed - so please test before deploying
   such a setup in production.
 
+Conntrack State Migration
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+NOTE: Conntrack state migration is considered best-effort only and might not
+work, as it heavily depends on the network setup.
+
+Conntrack is a Linux kernel mechanism to enable a stateful firewall by tracking
+individual connection. When live migrating running VMs, active in- and/or
+outbound connections *might* get interrupted as soon as the VM starts running on
+the target host, as the new host node does not have the same conntrack entries
+and thus the firewall can drop packets.
+
+Conntrack state migration copies all conntrack entries on the host for the
+live-migrated VM to the target node and afterwards flushes the migrated entries
+from the conntrack table on the source node.
+
 Offline Migration
 ~~~~~~~~~~~~~~~~~
 
-- 
2.49.0



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

