Counters

With nftables you need to explicitly specify a counter for each rule you want to count.

Anonymous counters

The following example uses an unnamed counter to count all tcp traffic routed to your host:

table ip counter_demo {
    chain IN {
        type filter hook input priority filter; policy drop;

        protocol tcp counter
    }
}

Note that the position of the counter statement within your rule is significant, because nftables evaluates expressions and statements linearly from left to right. If the above rule were written instead:

        counter protocol tcp

then every packet routed to your host (not just tcp packets) will update the counter!

Named counters

You can also declare named counters, which you can reference from multiple rules, e.g.:

table inet named_counter_demo {

    counter cnt_http {
    }

    chain IN {
        type filter hook input priority filter; policy drop;

        tcp dport   80 counter name cnt_http
        tcp dport  443 counter name cnt_http
   }
}

The above example defines a named counter cnt_http and uses it in two rules in order to count both http and https packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; these two rules can easily be combined by using an anonymous set.)