are the four conntrack states NEW, ESTABLISHED, RELATED and INVALID all-encompassing? that is, does every single packet fall into one and only one of these states? more to the point, what decides that a packet is NEW, given that it's possible for it to be categorized as NEW despite the fact that it has no SYN bit set? (i just noticed the part in the docs about identifying traffic that's NEW but also "-p tcp ! --syn". rday
