Data types

Data types used in Netfilter

The following data types are used in nft selectors:

Netfilter Data Types
Data Type	Description	nft Selector(s)	Notes
day	Either a day of week ("Monday", "Tuesday", etc.), or an integer between 0 and 6. Strings are matched case-insensitively, and a full match is not expected (e.g. "Mon" would match "Monday"). When an integer is given, 0 is Sunday and 6 is Saturday.	meta
devgroup_type	Device group (32 bit integer).	meta	Can be specified numerically or as symbolic name defined in /etc/iproute2/group.
ether_type	EtherType (16 bit integer).	meta	ether.h has known types. NOTE that ether.h lists EtherTypes in network order, while nft uses little-endian order on x86. (Check output of nft describe ether_type.)
gid	Group ID (32 bit integer).	meta	Can be specified numerically or as group name.
hour	A string representing an hour in 24-hour format. Seconds can optionally be specified. For example, 17:00 and 17:00:00 would be equivalent.	meta
iface_index	Interface index (32 bit integer).	meta	Can be specified numerically or as name of an existing interface. Use ifname instead for interfaces whose name and/or index can change (i.e. those that appear / disappear dynamically).
iface_type	Interface type (16 bit integer).	meta
ifkind	Interface kind (16 byte string).	meta	List of ifkinds is in man 8 ip-link TYPES section.
ifname	Interface name (16 byte string).	meta	Does not have to exist. Slower than iface_index but good for interfaces that can dynamically appear / disappear.
pkt_type	Packet type: host - addressed to local host broadcast - to all multicast - to group other - addressed to another host	meta
realm	Routing Realm (32 bit integer).	meta	Can be specified numerically or as symbolic name defined in /etc/iproute2/rt_realms. Routing realm references: linux-ip.net policyrouting.org
time	Either an integer or a date in ISO format. For example: "2019-06-06 17:00". Hour and seconds are optional and can be omitted if desired. If omitted, midnight will be assumed. The following three would be equivalent: "2019-06-06", "2019-06-06 00:00" and "2019-06-06 00:00:00". When an integer is given, it is assumed to be a UNIX timestamp.	meta
uid	User ID (32 bit integer).	meta	Can be specified numerically or as user name.

nft describe

You can use nft describe to get information about a data type, to find out the data type of a particular selector, and to list predefined symbolic constants for that selector. Some examples:

% nft describe iif
meta expression, datatype iface_index (network interface index) (basetype integer), 32 bits

% nft describe iifname
meta expression, datatype ifname (network interface name) (basetype string), 16 characters

% nft describe tcp flags
payload expression, datatype tcp_flag (TCP flag) (basetype bitmask, integer), 8 bits

pre-defined symbolic constants (in hexadecimal):
        fin                             0x01
        syn                             0x02
        rst                             0x04
        psh                             0x08
        ack                             0x10
        urg                             0x20
        ecn                             0x40
        cwr                             0x80