<p>I have an application in Docker Container which connects with the host application using SCTP protocol. When this container is deployed on Kubernetes Pods, connectivity with this pod from another pod inside a cluster is working fine.
I have tried exposing this pod using a Load Balancer Service and NodePort service externally. When the host application tries to connect to this pod, I am getting an intermittent &quot;Connection Reset By Peer&quot; error. Sometimes after 1st request itself and sometimes after 3rd request.
I have tried other SCTP based demo containers other than my application but having the same issue, where after certain no. of request getting connection reset by peer error. So it isn't problem of my appliation.</p>
<p>My application is listening to the correct port. Below is the output of the command &quot;netstat -anp&quot; inside the pod.</p>
<pre><code>Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 10.244.0.27:80          0.0.0.0:*               LISTEN      4579/./build/bin/AM 
sctp                10.244.0.27:38412                               LISTEN      4579/./build/bin/AM 
</code></pre>
<p>My Service file is given below:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  clusterIP: 10.100.0.2
  selector:
    app: my-app
  type: NodePort
  ports:
  - name: sctp
    protocol: SCTP
    port: 38412
    targetPort: 38412
    nodePort : 31000
  - name: tcp
    protocol: TCP
    port: 80
    targetPort: 80
</code></pre>
<p>I have this whole setup on Minikube.I haven't used any CNI. I am stuck due to this. Am I missing something ?  Since I am working with K8s for the last 2 weeks only. Please help with this issue, and if possible mention any resource regarding SCTP on Kubernetes, since I could find very little.</p>
<p>The following is the tcpdump collected from inside the pod running the sctp connection.</p>
<pre><code>tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:59:02.410219 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 100)
    10.244.0.1.41024 &gt; amf-6584c544-cvvrs.31000: sctp (1) [INIT] [init tag: 2798567257] [rwnd: 106496] [OS: 2] [MIS: 100] [init TSN: 2733196134] 
20:59:02.410260 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 324)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.41024: sctp (1) [INIT ACK] [init tag: 1165596116] [rwnd: 106496] [OS: 2] [MIS: 2] [init TSN: 4194554342] 
20:59:02.410308 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 296)
    10.244.0.1.41024 &gt; amf-6584c544-cvvrs.31000: sctp (1) [COOKIE ECHO] 
20:59:02.410348 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.41024: sctp (1) [COOKIE ACK] 
20:59:02.410552 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 100)
    10.244.0.1.5369 &gt; amf-6584c544-cvvrs.31000: sctp (1) [INIT] [init tag: 2156436948] [rwnd: 106496] [OS: 2] [MIS: 100] [init TSN: 823324664] 
20:59:02.410590 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 324)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.5369: sctp (1) [INIT ACK] [init tag: 2865549963] [rwnd: 106496] [OS: 2] [MIS: 2] [init TSN: 1236428521] 
20:59:02.410640 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 296)
    10.244.0.1.5369 &gt; amf-6584c544-cvvrs.31000: sctp (1) [COOKIE ECHO] 
20:59:02.410673 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.5369: sctp (1) [COOKIE ACK] 
20:59:04.643163 IP (tos 0x2,ECT(0), ttl 64, id 58512, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; host.minikube.internal.5369: sctp (1) [HB REQ] 
20:59:05.155162 IP (tos 0x2,ECT(0), ttl 64, id 58513, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
20:59:05.411135 IP (tos 0x2,ECT(0), ttl 64, id 60101, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; charles-02.41024: sctp (1) [HB REQ] 
20:59:05.411293 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.41024 &gt; amf-6584c544-cvvrs.31000: sctp (1) [ABORT] 
20:59:06.179159 IP (tos 0x2,ECT(0), ttl 64, id 58514, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
20:59:06.403172 IP (tos 0x2,ECT(0), ttl 64, id 58515, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; host.minikube.internal.5369: sctp (1) [HB REQ] 
20:59:06.695155 IP (tos 0x2,ECT(0), ttl 64, id 58516, offset 0, flags [DF], proto SCTP (132), length 92)
    amf-6584c544-cvvrs.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
20:59:06.695270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.5369 &gt; amf-6584c544-cvvrs.31000: sctp (1) [ABORT] 
20:59:09.584088 IP (tos 0x2,ECT(0), ttl 63, id 1, offset 0, flags [DF], proto SCTP (132), length 116)
    10.244.0.1.41024 &gt; amf-6584c544-cvvrs.31000: sctp (1) [DATA] (B)(E) [TSN: 2733196134] [SID: 0] [SSEQ 0] [PPID 0x3c] 
20:59:09.584112 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.41024: sctp (1) [ABORT] 
20:59:10.530610 IP (tos 0x2,ECT(0), ttl 63, id 1, offset 0, flags [DF], proto SCTP (132), length 40)
    10.244.0.1.5369 &gt; amf-6584c544-cvvrs.31000: sctp (1) [SHUTDOWN] 
20:59:10.530644 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    amf-6584c544-cvvrs.31000 &gt; 10.244.0.1.5369: sctp (1) [ABORT]
</code></pre>
<p>The following is the tcpdump collected from the host trying to connect.</p>
<pre><code>tcpdump: listening on br-c54f52300570, link-type EN10MB (Ethernet), capture size 262144 bytes
02:29:02.410177 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 100)
    charles-02.58648 &gt; 192.168.49.2.31000: sctp (1) [INIT] [init tag: 2798567257] [rwnd: 106496] [OS: 2] [MIS: 100] [init TSN: 2733196134] 
02:29:02.410282 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 324)
    192.168.49.2.31000 &gt; charles-02.58648: sctp (1) [INIT ACK] [init tag: 1165596116] [rwnd: 106496] [OS: 2] [MIS: 2] [init TSN: 4194554342] 
02:29:02.410299 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 296)
    charles-02.58648 &gt; 192.168.49.2.31000: sctp (1) [COOKIE ECHO] 
02:29:02.410360 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    192.168.49.2.31000 &gt; charles-02.58648: sctp (1) [COOKIE ACK] 
02:29:02.410528 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 100)
    charles-02.54336 &gt; 192.168.49.2.31000: sctp (1) [INIT] [init tag: 2156436948] [rwnd: 106496] [OS: 2] [MIS: 100] [init TSN: 823324664] 
02:29:02.410610 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 324)
    192.168.49.2.31000 &gt; charles-02.54336: sctp (1) [INIT ACK] [init tag: 2865549963] [rwnd: 106496] [OS: 2] [MIS: 2] [init TSN: 1236428521] 
02:29:02.410630 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 296)
    charles-02.54336 &gt; 192.168.49.2.31000: sctp (1) [COOKIE ECHO] 
02:29:02.410686 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    192.168.49.2.31000 &gt; charles-02.54336: sctp (1) [COOKIE ACK] 
02:29:04.643276 IP (tos 0x2,ECT(0), ttl 63, id 58512, offset 0, flags [DF], proto SCTP (132), length 92)
    192.168.49.2.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
02:29:04.643303 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.5369 &gt; 192.168.49.2.31000: sctp (1) [ABORT] 
02:29:05.155288 IP (tos 0x2,ECT(0), ttl 63, id 58513, offset 0, flags [DF], proto SCTP (132), length 92)
    192.168.49.2.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
02:29:05.155322 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.5369 &gt; 192.168.49.2.31000: sctp (1) [ABORT] 
02:29:06.179324 IP (tos 0x2,ECT(0), ttl 63, id 58514, offset 0, flags [DF], proto SCTP (132), length 92)
    192.168.49.2.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
02:29:06.179376 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.5369 &gt; 192.168.49.2.31000: sctp (1) [ABORT] 
02:29:06.403290 IP (tos 0x2,ECT(0), ttl 63, id 58515, offset 0, flags [DF], proto SCTP (132), length 92)
    192.168.49.2.31000 &gt; charles-02.5369: sctp (1) [HB REQ] 
02:29:06.403332 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    charles-02.5369 &gt; 192.168.49.2.31000: sctp (1) [ABORT] 
02:29:09.584056 IP (tos 0x2,ECT(0), ttl 64, id 1, offset 0, flags [DF], proto SCTP (132), length 116)
    charles-02.58648 &gt; 192.168.49.2.31000: sctp (1) [DATA] (B)(E) [TSN: 2733196134] [SID: 0] [SSEQ 0] [PPID 0x3c] 
02:29:09.584132 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    192.168.49.2.31000 &gt; charles-02.58648: sctp (1) [ABORT] 
02:29:10.530566 IP (tos 0x2,ECT(0), ttl 64, id 1, offset 0, flags [DF], proto SCTP (132), length 40)
    charles-02.54336 &gt; 192.168.49.2.31000: sctp (1) [SHUTDOWN] 
02:29:10.530668 IP (tos 0x2,ECT(0), ttl 63, id 0, offset 0, flags [DF], proto SCTP (132), length 36)
    192.168.49.2.31000 &gt; charles-02.54336: sctp (1) [ABORT]
</code></pre>

The Average Developer
<p>You cannot expose port 38412 via NodePort.</p>
<blockquote>
<p>If you set the type field to NodePort, the Kubernetes control plane allocates a port from a range specified by --service-node-port-range flag <strong>(default: 30000-32767)</strong>. Each node proxies that port (the same port number on every Node) into your Service. Your Service reports the allocated port in its .spec.ports[*].nodePort field.</p>
</blockquote>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport</a></p>
<p>Take a look at this link to understand how to translate the port:
<a href="https://stackoverflow.com/questions/71100744/unable-to-expose-sctp-server-running-in-a-kubernetes-pod-using-nodeport">Unable to expose SCTP server running in a kubernetes pod using NodePort</a></p>
<p>Also, make sure you are using Calico as a network plugin (minimum version 3.3).</p>
<blockquote>
<p>Kubernetes 1.12 includes alpha Stream Control Transmission Protocol (SCTP) support. Calico v3.3 has been updated to support SCTP if included in your network policy spec.</p>
</blockquote>
