Pablo, When developing a conntrack offload driver, I was quite surprised to find that CT entries passed to the driver's flow-block callback (as registered with nf_flow_table_offload_add_cb()) include a match on ingress_ifindex, with mask 0xffffffff and key 0. This is especially confusing as AIUI 0 is not a valid ifindex.