Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Identifying Inbound Packet Drops with NFTables Counters

🧩 The Challenge

You suspect a firewall rule is silently discarding traffic, but standard logs are too verbose or disabled.

💡 The Fix

Attach a dedicated counter to your suspicious firewall chain to track rejected packets in real-time without cluttering your system logs.

nft add rule ip filter input tcp dport 22 counter
nft list ruleset

⚙️ Why It Works

Adding a counter object to a rule increments a persistent tally every time a packet matches, allowing you to confirm packet loss volume via simple ruleset inspection.

🚀 Pro-Tip: Use nft reset ruleset to clear all counter values to zero after you have finished debugging your specific traffic flow.

Linux Tips & Tricks | © ngelinux.com | 7/9/2026