This cryptic nonsense shows up in the output from dmesg: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. So how would a mere mortal know if he needs br_netfilter or not?