Slow "nft list counters"
Stephan Ferlin-Reiter <[email protected]> Mon, 6 Oct 2025 12:39:56 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <CAFctyt+UdMz_yJYg=dMojijFZXdHT8aUyb7ga7Cme-NdYRP-gw@mail.gmail.com> |
Hi, On a host I have many network interfaces with associated nftables rules and named counters. I’d like to get the state of the counters and thought about running “nft -j list counters”. That seems to take many seconds, however. As an alternative I wrote a small program that talks netlink and sends a dump request with NFT_MSG_GETOBJ for the tables I care about. That takes just milliseconds. Now I’m wondering whether I’m missing something in my program - I do seem to get what I care about. I’m also curious as to why the operation with the nft tool takes so long. Is it maybe looking at all the rules, which are complex in my case? Thanks Stephan