[pve-devel] [PATCH docs v4 14/14] qm: document conntrack state migration for live migrations

[Christoph Heiss]

Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>
---
Changes v2 -> v3:
  * new patch

Changes v3 -> v4:
  * no changes

 qm.adoc | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/qm.adoc b/qm.adoc
index 393242a..e1bb78b 100644
--- a/qm.adoc
+++ b/qm.adoc
@@ -1672,6 +1672,22 @@ For Live Migration to work, there are some things required:
   configured, but it cannot be guaranteed - so please test before deploying
   such a setup in production.
 
+Conntrack State Migration
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+NOTE: Conntrack state migration is considered best-effort only and might not
+work, as it heavily depends on the network setup.
+
+Conntrack is a Linux kernel mechanism to enable a stateful firewall by tracking
+individual connection. When live migrating running VMs, active in- and/or
+outbound connections *might* get interrupted as soon as the VM starts running on
+the target host, as the new host node does not have the same conntrack entries
+and thus the firewall can drop packets.
+
+Conntrack state migration copies all conntrack entries on the host for the
+live-migrated VM to the target node and afterwards flushes the migrated entries
+from the conntrack table on the source node.
+
 Offline Migration
 ~~~~~~~~~~~~~~~~~
 
-- 
2.49.0