Slow "nft list counters"

Stephan Ferlin-Reiter <[email protected]> Mon, 6 Oct 2025 12:39:56 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <CAFctyt+UdMz_yJYg=dMojijFZXdHT8aUyb7ga7Cme-NdYRP-gw@mail.gmail.com>
Hi,

On a host I have many network interfaces with associated nftables
rules and named counters. I’d like to get the state of the counters
and thought about running “nft -j list counters”. That seems to take
many seconds, however. As an alternative I wrote a small program that
talks netlink and sends a dump request with NFT_MSG_GETOBJ for the
tables I care about. That takes just milliseconds.

Now I’m wondering whether I’m missing something in my program - I do
seem to get what I care about. I’m also curious as to why the
operation with the nft tool takes so long. Is it maybe looking at all
the rules, which are complex in my case?

Thanks
Stephan