Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Catch phantom traffic with nftables tracing

🧩 The Challenge

Dealing with a production service that randomly drops packets is absolute torture when your firewall rules look perfect but the traffic still disappears into the void. I spent three hours last week chasing a rogue drop rule that I swore didn’t exist until I actually saw the packets hitting the floor.

💡 The Fix

Instead of guessing why a connection is failing, you can turn on nftables tracing to see exactly which rule is nuking your traffic in real time. It makes the invisible logic of your packet filtering finally show its face.

nft add rule ip filter input ip saddr 192.168.1.50 meta nftrace set 1
nft monitor trace

⚙️ Why It Works

By tagging specific packets with a trace flag, the kernel sends events back to userspace every time a rule matches, effectively giving you a play-by-play of the packet’s journey. You’ll see the exact rule handle that finally triggers the drop.

🚀 Pro-Tip: Don’t forget to delete that trace rule after you finish debugging, or you’ll tank your system performance from all the extra logging.

Linux Tips & Tricks | © ngelinux.com | 10/15/2026