Currently, for UDP connections that existed before Retina was deployed, conntrack uses a best-effort approach, relying on traffic direction based on the observation point. However, this method can be inaccurate. Implement a self-correcting mechanism in case the direction is incorrect. A possible solution could be using packet size and timing information to infer the direction of the connection.
FYI @nddq