Matching packet header fields
The nft command line utility supports the following layer 4 protocols: AH, ESP, UDP, UDPlite, TCP, DCCP, SCTP and IPComp.
Matching transport protocol
The following rule shows how to match any kind of TCP traffic:
% nft add rule filter output ip protocol tcp
Matching Ethernet header fields
If you want to match ethernet traffic whose destination address is ff:ff:ff:ff:ff:ff, you can type the following command:
% nft add rule filter input ether daddr ff:ff:ff:ff:ff:ff counter
Do not forget that the layer 2 header information is only available in the input path.
Matching IPv4 header fields
You can also match traffic based on the IPv4 source and destination, the following example shows how to account all traffic that comes from 192.168.1.100 and that is addressed to 192.168.1.1:
% nft add rule filter input ip saddr 192.168.1.100 ip daddr 192.168.1.1 counter
Note that, since the rule is attached to the input chain, your local machine needs to use the 192.168.1.1 address, otherwise you won't see any matching ;-).
To filter on a layer 4 protocol like TCP, you can use the protocol keyword:
% nft add rule filter input protocol tcp counter
Matching IPv6 header fields
If you want to account IPv6 traffic that is addressed to abdc::100, you can type the following command:
% nft add rule filter output ip6 daddr abcd::100 counter
To filter on a layer 4 protocol like TCP, you can use the nexthdr keyword:
% nft add rule filter input ip6 nexthdr tcp counter
NOTE: the syntax mixing IPv6/IPv4 notation is not supported yet: '::ffff:192.168.1.0'
Matching TCP/UDP/UDPlite traffic
The following examples shows how to drop all tcp traffic for low TCP ports (1-1024):
% nft add rule filter input tcp dport 1-1024 counter drop
Note that this rule is using an interval (from 1 to 1024).
To match on TCP flags, you need to use binary operation. For example, to count packet that are not SYN one:
% nft add rule filter input tcp flags != syn counter
More complex filters can be used. For example, to count and log TCP packet with flag SYN and ACK set:
% nft -i nft> add rule filter output tcp flags & (syn | ack) == syn | ack counter log
Matching ICMP traffic
You can drop all ICMP echo request (popularly known as ping) via:
% nft add rule filter input icmp type echo-request counter drop
Here is the list of available icmp types: