search for: nf_conntrack_cor

....) Might only need to check (and then keep the existing value) if existing timeout is longer than new value in "int [proto]_packet()" in net/netfilter/nf_conntrack_proto_[proto].c for each protocol. Alternatively might be easier to do the check in __nf_ct_refresh_acct() in net/netfilter/nf_conntrack_core.c. But notice that "if (newtime - ct->timeout.expires >= HZ)" there has an integer underflow when newtime is smaller than ct->timeout.expires, and some things are currently relying on it, e.g. in tcp_packet() when a TCP connection coming out of ESTABLISHED has its timeout reduce...