Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop staring at empty connection logs when you know the packets are hitting the box

🧩 The Challenge

You are dead sure your firewall rules allow the traffic, but your application logs stay quiet as a graveyard. It’s infuriating when tcpdump shows the handshake arriving but the server just drops the connection into a black hole.

💡 The Fix

Use the trace feature in nftables to watch exactly which rule is killing your traffic in real time. It saves you from guessing which permit rule is actually being shadowed by an earlier drop.

nft add rule ip filter input tcp dport 8080 meta nftrace set 1
nft monitor trace

⚙️ Why It Works

Setting the nftrace bit acts like a debugger for your packet flow, forcing the kernel to dump a log of every rule the packet hits. Once you see the chain and rule handle that triggers the drop, you can fix your rule set without the usual trial and error.

🚀 Pro-Tip: Don’t forget to remove the trace rule immediately after debugging, or your logs will fill up faster than you can blink.

Linux Tips & Tricks | © ngelinux.com | 9/21/2026