mark-connection passthrough=no lets packets through

RouterOS Beginner Basics
1

I have a strange problem - some packets seem to drip through the mark-connection mangle rule with, which is supposed to match all, despite passthrough=no setting. What’s wrong?

/ip firewall mangle
add action=mark-connection chain=input comment="mark input as priority" new-connection-mark=conn-priority passthrough=no
add action=log chain=input comment="unmarked packets fallout count" log=yes log-prefix=fallout

I see some things get logged, why?

And router first does its mangling, then filter, correct?

2

well, i have to talk to myself - mangling is done first, then filtering.
which is also the reason why, i think, connection marking lets through some packets - those packets are invalid and therefore connection manager discards is, so also connection marking does not work.
the packets, that pass through connection marking, are then dropped by filtering rule to clear invalid connections.
i think:)