- it actually requires libnetfilter_conntrack 1.0.3 (IPCTNL_MSG_CT_GET_DYING and IPCTNL_MSG_CT_GET_UNCONFIRMED)