npf_conn_lookup
conn = npf_conn_lookup(&enpc, di, &flow);
if ((con = npf_conn_lookup(npc, di, &flow)) == NULL) {
npf_conn_t * npf_conn_lookup(const npf_cache_t *, const unsigned, npf_flow_t *);