refactor duplex conn tracker as standalone service hogging on root