@jdive I would volunteer to help stress performance impact if you wrote the

conntrack

publisher. In the past for the UDEV/audit publishers I compared cost using Apache's benchmarking suites.