Debug nftables rules

The nftables framework provides different options for administrators to debug rules and if packets match them.

Create a rule with a counter
Copy link

To identify if a rule is matched, you can use a counter.

Before you begin
Copy link

  • The chain to which you want to add the rule exists.

Procedure
Copy link

  1. Add a new rule with the counter parameter to the chain. The following example adds a rule with a counter that allows TCP traffic on port 22 and counts the packets and traffic that match this rule: 
    # nft add rule inetexample_tableexample_chaintcp dport 22 counter accept
  2. To display the counter values: 
    # nft list ruleset
     
    table inet example_table {
  chain example_chain {
    type filter hook input priority filter; policy accept;
    tcp dport ssh counter packets 6872 bytes 105448565 accept
  }
}

Add a counter to an existing rule
Copy link

To identify if a rule is matched, you can use a counter.

Before you begin
Copy link

  • The rule to which you want to add the counter exists.

Procedure
Copy link

  1. Display the rules in the chain including their handles: 
    # nft --handle list chain inetexample_tableexample_chain
     
    table inet example_table {
  chain example_chain { # handle 1
    type filter hook input priority filter; policy accept;
    tcp dport ssh accept # handle 4
  }
}
  2. Add the counter by replacing the rule but with the counter parameter. The following example replaces the rule displayed in the previous step and adds a counter: 
    # nft replace rule inetexample_tableexample_chain handle 4tcp dport 22 counter accept
  3. To display the counter values: 
    # nft list ruleset
     
    table inet example_table {
  chain example_chain {
    type filter hook input priority filter; policy accept;
    tcp dport ssh counter packets 6872 bytes 105448565 accept
  }
}

Monitor packets that match an existing rule
Copy link

To display packets that match a rule, you can use the tracing feature in nftables in combination with the nft monitor command. You can enable tracing for a rule and use it to monitor packets that match this rule.

Before you begin
Copy link

  • The rule to which you want to add the counter exists.

Procedure
Copy link

  1. Display the rules in the chain including their handles: 
    # nft --handle list chain inetexample_tableexample_chain
     
    table inet example_table {
  chain example_chain { # handle 1
    type filter hook input priority filter; policy accept;
    tcp dport ssh accept # handle 4
  }
}
  2. Add the tracing feature by replacing the rule but with the meta nftrace set 1 parameters. The following example replaces the rule displayed in the previous step and enables tracing: 
    # nft replace rule inetexample_tableexample_chain handle 4tcp dport 22 meta nftrace set 1 accept
  3. Use the nft monitor command to display the tracing. The following example filters the output of the command to display only entries that contain inet example_table example_chain: 
    # nft monitor | grep "inet example_table example_chain"
     
    trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240
trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
...
    Warning

    Depending on the number of rules with tracing enabled and the amount of matching traffic, the nft monitor command can display a lot of output. Use grep or other utilities to filter the output.