Note that this means that conntrack's window tracking has to be perfectly in sync with both endpoints (assuming TCP invalids are dropped). Given endpoints tend

Note that this means that conntrack's window tracking has to be perfectly in sync with both endpoints (assuming TCP invalids are dropped). Given endpoints tend to be updated more often than middleboxes, this isn't a great assumption to make.