Re: list elements of set

Thank you for response and deeper insight.

the following command seems to work:

sudo nft 'list set basetable mx_bans_cidr'

output:

table ip basetable {
	set mx_bans_cidr {
		type ipv4_addr
		flags interval
		counter
		auto-merge
		elements = { 1.1.1.0/24 counter packets 0 bytes 0, 2.2.2.0/24 counter
packets 0 bytes 0, etc ...
}



The output is a bit "verbose". Is it possible to retrieve only the
ip/cidr elements without the "table ip basetable { ... " 
lines?

I still have to use cut, sed or awk to retrieve the ip ranges only.

Ideally I would only get:

1.1.1.0/24
2.2.2.0/24
.
.
.


But anyway, you answer got me closer to the expected result. :)
Thank you,
have a great weekend.




On Sep 27 2025, at 11:39 am, Kerin Millar <[email protected]> wrote:

> On Sat, 27 Sep 2025, at 9:06 AM, 0x1 | nftables wrote:
>> Hello everyone,
>> 
>> I would like to list all ipv4 elements of a named set. 
>> 
>> the set is named
>> 
>> mx_bans_cidr
> 
> This does not show the table in which the set resides, nor the address
> family associated with the table (which can be "ip", "ip6" or "inet").
> It is the combination of these two things that qualifies any given table.
> 
>> 
>> the command i used:
>> 
>> sudo nft list set ip filter mx_bans_cidr
>> 
>> Error: No such file or directory
>> list set ip filter mx_bans_cidr
> 
> The command is valid. It's simply stating that there is no set named
> "mx_bans_cidr" in the "ip filter" table. You might even not have a
> table named "ip filter" at all.
> 
>> 
>> 
>> I followed the description from this page
>> 
>> https://wiki.nftables.org/wiki-nftables/index.php/Sets#Listing_named_sets
>> 
>> 
>> The query for element in a set is also not working.
>> 
>> I tried all kind of versions of the command, one that surprised me was:
>> 
>> 
>> sudo nft get element ip basetable filter mx_bans_cidr { *.*.*.* }
> 
> Here, you specify a family of "ip" and a name of "basetable". But you
> also follow it with "filter", which doesn't make any sense. A table
> cannot have two names. Presumably, "ip basetable" would be correct in
> your case.
> 
> # nft 'list set ip basetable mx_bans_cidr'
> 
> If you have any doubt as to the naming of your tables, you could try
> listing all sets without their contents initially.
> 
> # nft -t 'list sets'
> 
>> 
>> Error: syntax error, unexpected string, expecting '{' or '$'
>> get element ip basetable filter mx_bans_cidr { somefile-x.x.x.tar.gz
>> someotherfile-y.y.y.tar.gz }
>> 
>> Those are 2 files, that contain 4 dots in the filename, in the working
>> directory ?!
> 
> Indeed. That's your shell performing pathname expansion in accordance
> with the Shell Command Language specification. This is why I always
> recommend that nft(8) commands be conveyed as a single word through
> the use of quoting, if issuing them from a shell. For example:
> 
> # nft 'list set ip basetable mx_bans_cidr'
> 
> Everything between the single quotes will be taken literally and
> passed along to nft(8) as a single argument. No pathname expansion is
> possible then.
> 
> I wrote some material for the wiki that also touches upon the use of
> the shell. See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Syntactic_conventions.
> 
> -- 
> Kerin Millar
>