v0.1.2 — complete nftables firewall monitoring

nft_exporter v0.1.2

Complete nftables firewall monitoring over NFNETLINK (ADR-0030) — direct native-API forensics for the firewall.

Added — 14 nftables metrics

• nft_rule_counter_{bytes,packets}_total{table,chain,comment} — per-rule hit counters keyed by rule comment (the "which rule matched/dropped" forensic), parsed from NFTA_RULE_EXPRESSIONS + NFTA_RULE_USERDATA. Anonymous rules suppressed; hard cap of 1000 emitted series (overflow surfaces on nft_scrape_collector_error_total{reason="cardinality_overflow"}).
• nft_chain_info{table,chain,type,hook,priority,policy}, nft_table_info, nft_set_elements{table,name,type}.
• nft_named_counter/quota/limit_* (named-object stats incl. quota/limit exhaustion), nft_ruleset_generation (change detection), nft_flowtable_info.

Fixed

• nftables.family_label: corrected NFPROTO_* values (3=arp, 5=netdev, 7=bridge, 10=ip6) — were wrong for bridge/arp families.
• nftables scrape no longer hangs: each dump now uses a fresh netlink socket (sequential dumps on a shared socket stalled), and GETGEN is a single request_single (not an NLM_F_DUMP that blocks on a never-sent NLMSG_DONE).

Known issues

• nftables set key-type label falls back to other for some key types (the element count is correct).

---

Install (Debian/Ubuntu, x86_64 glibc)

curl -sSLO https://github.com/farchanjo/netlink_exporter/releases/download/v0.1.2/netlink-exporter_0.1.2_amd64.deb
sudo apt install ./netlink-exporter_0.1.2_amd64.deb   # systemd service on :33400, drop_monitor enabled

Or the raw glibc binary: netlink_exporter-v0.1.2-x86_64-unknown-linux-gnu.tar.gz.

Built with Rust 1.96.0, edition 2024, optimized release (lto=fat, codegen-units=1, strip). SHA256SUMS attached.

v0.1.1

Maintenance release. Dynamic glibc x86_64. Default port and drop_monitor behavior changed — see below.

Changed

• Default HTTP port 9456 → 33400 (configurable via NLX_LISTEN_ADDR / --listen-addr).
• Rust 1.96 (edition 2024); optimized release profile (opt-level=3, lto=fat, codegen-units=1, strip).
• nic_pcie AER aggregated per device (dropped the kind label) — ~91% fewer series.
• Builds are dynamic glibc (musl dropped — monoio is glibc-only); glibc distroless image.

Added

• Debian package (netlink-exporter_0.1.1_amd64.deb): systemd unit, /etc/default/nft_exporter (EnvironmentFile), conffiles. Depends: libc6, libcap2-bin.
• Rewritten Makefile — make deb / make release / lint / test.

Fixed

• drop_monitor works under the packaged service: startup CAP_SYS_ADMIN (NET_DM multicast join) is granted via file capabilities (setcap) — systemd ambient caps don't satisfy it. The service runs non-root and the binary drops to CAP_NET_ADMIN after the join.
• Cleared pre-existing clippy warnings in the procfs collectors.

Install

```sh
curl -sSLO https://github.com/farchanjo/netlink_exporter/releases/download/v0.1.1/netlink-exporter_0.1.1_amd64.deb
sudo apt install ./netlink-exporter_0.1.1_amd64.deb # service on :33400, drop_monitor enabled
```

Verify: `sha256sum -c SHA256SUMS --ignore-missing`

v0.1.0

First release of nft_exporter — a Prometheus exporter for full Linux network observability via direct AF_NETLINK on a monoio / io_uring runtime.

Collectors (21)

Native netlink/genetlink (13, default-on): rtnetlink, rtnetlink-extended, traffic_control, conntrack, conntrack_expect, nftables, sock_diag, ethtool, ipvs, wireguard, devlink, drop_monitor, xfrm.

Opt-in procfs/sysfs (8, default-off, ADR-0027): softnet, netstat, softirq, irq, sockstat, nic_bql, nic_pcie, nic_temp.

Highlights

• Native-API-first (ADR-0025): direct netlink wire protocol over io_uring (ADR-0011 / ADR-0023 / ADR-0024) — no high-level netlink crates, no tokio/axum.
• Opt-in procfs/sysfs relax (ADR-0027) for signals with no netlink API; isolated in the nlx-procfs crate behind a read-only path allowlist, default-off.
• Bounded cardinality: nic_pcie AER counters aggregated per device (ADR-0028); duplicate-series guard in the serializer.
• Exposition: Prometheus text 0.0.4.
• Architecture: hexagonal (ADR-0002); CAP_NET_ADMIN-only privilege drop.

Verified live: 21/21 collectors reporting, 0 duplicate series, clippy/fmt clean, full unit-test suite green.