Re: Nftables ct count over 2 counter continues to trigger with only 1 connection

On Mon, Oct 27, 2025 at 02:54:59PM +0100, [email protected] wrote:
> > After looking at Fernandos analysis, does this work when you restrict
> > this to new packets, i.e.:
> 
> Thanks for spending time on this. I can confirm that adding the restriction with the inline jump works great! Of course, it would still be great if the original rules behaved predictably as well.
> 
> As an end-user trying to learn, the man documentation surrounding conntrack and especially packet path dynamic set add/update with `ct count over` and similar could be improved. The dynamic set flag also lists "delete" as a valid option with no other references to it which felt odd.

Please send us patches that can be reviewed, it will take a bit of
time on you but it could possibly kick off some discussions, thanks.