IPCT_NEW comes from was Re: extending conntrack event data

[Amin Azez <azez@ufomechanic.net>]

Looking at some of my skb->nfcache debugging
(de8ce580 is the skb address)

during tcp_packet, I get calls to ip_conntrack_event_cache which changes 
nfcache thus:
* event_cache on de8ce580 from 4000 to 4040
* event_cache on de8ce580 from 4040 to 4060
* {leave tcp_packet}
* event_cache on de8ce580 from 4060 to 4068
* event_cache on de8ce580 from 4068 to 4078
* deliver_cached_events c079 right now skb de8ce580

By the time ip_confirm is called some more stuff has happened to 
nfcache, hence ip_confirm c079 de8ce580

Question is how did the nfcache get from 4078 to c079
It was c079 when ip_confirm was called

Whence the extra 8001 that has been combined? The 1 is IPCT_NEW, the 
8000 is NFC_ALTERED

NFC_ALTERED is used in various places, the most like in 
ip_ct_gather_frags but this hardly seems likely if src and dst machines 
are on the same subnet?
I confirmed with logging that it isn't there so I will have to add debug 
to all the other places to see which one is guilty.

Azez