What about that old USB key that has been lying about for ages? Or that USB hard drive people are using to swap files? Or that dodgy encrypted file that's come in over email? We also discovered malware on a critical DVD that someone at the company ha...
While logged in as root, you can also run "modprobe ip_conntrack_tftp" and "modprobe ip_conntrack_ftp" which doesn't require a restart of ncs or iptables.