Hi, It looks like that there are two ways to check if a timer for conntrack is active or not. ct->timeout->list.next != NULL test_bit(IPS_CONFIRMED_BIT, &ct->status) Is there any difference between these two checks? Thanks, Richard