conntrack update - spawn instead of exec