Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Catch those dropped packets before they ruin your afternoon

🧩 The Challenge

Dealing with a service that intermittently acts like it’s dead, but every internal check comes back green. I spent three hours last week chasing a ghost only to find out the firewall was silently nuking packets that didn’t fit the expected state.

💡 The Fix

Start using the trace feature in nftables to see exactly which rule is killing your traffic in real time. It saves you from guessing if it’s the packet filter or just the application being flaky.

nft add rule ip filter input ip saddr 1.2.3.4 log prefix "FIREWALL_DROP: " drop

⚙️ Why It Works

Adding that log rule puts a breadcrumb trail straight into your dmesg or syslog the moment a packet matches the criteria. You can finally stop blind-testing rule sets and see the rejection happening live.

🚀 Pro-Tip: Pipe the output to dmesg -w so you can watch the drops roll in while you try to reproduce the failure.

Linux Tips & Tricks | © ngelinux.com | 10/23/2026