@theopolis question .. i am looking into coding a conntrack event table, making good progress .. now the phylosophical question … the core of the code will be around parsing the netlink messages with all attributes etc.. I can use libnetfilter-conntrack which does all the work which is good but only generate a string out of the attribute not a human reusable struct.