As seen in https://manpages.debian.org/testing/conntrackd/conntrackd.conf.5.en.html (conntrackd version 1:1.4.5-1)
StartupResync <on|off>
Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made. This is useful to get in sync with another node which has been running while we were down. Example: StartupResync on By default, this clause is set off.
(The command-line "-n" does the same if we want to trigger it on some events: https://manpages.debian.org/stretch/conntrackd/conntrackd.8.en.html -- that could be a RFE as well to be put as a command-line)
The use-cases are for rolling upgrade/restarts of firewalls in VRRP configuration:
Worst-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP BACKUP appliance, all is well. It goes back online and does not learn all the previous connections.
3- You restart the VRRP MASTER appliance, long-living pre-maintenance TCP connections do break.
Or Best-Case:
1- You have a long-lived TCP connection going thru the firewall.
2- You restart the VRRP MASTER appliance, all is well as the BACKUP has your connection state. It goes back online, becomes BACKUP and does not learn all the previous connections.
3- You restart the VRRP (BACKUP but now) new MASTER appliance, all is well as the BACKUP has your connection state.
4- In any event the VRRP state flips (backup now master, master now backup), long-living TCP connections do break.