Re: prefix len confusion

> table ip raw {
>     chain PREROUTING {
>         type filter hook prerouting priority raw;
>         ip daddr 42.642.11.82 tcp dport 22 meta nftrace set 1
>     }
> }
> 
> 
> Next, run "nft monitor trace".

thanks a million.  this showed pretty conclusively that the
`/etc/nftables.conf` was indeed correct and filtering as one
would hope/expect.  and i learned a new hack!

so we are now looking for more subtle attack surface, e.g. loose
source routing, bouncing off a legitimately open service on the
same LAN, etc.

we also see this (distributed source) attack on proxmox clusters' web
interfaces

    2026-06-07T02:01:39.274405+00:00 pv0 pvedaemon[2276]: authentication failure; rhost=::ffff:85.11.167.7 user=root@pam msg=Authentication failure
    2026-06-07T02:01:42.970943+00:00 pv0 pvedaemon[2277]: authentication failure; rhost=::ffff:85.11.167.7 user=root@pam msg=Authentication failure

can we safely just add ffff::0 to the v6 bogon list?

randy