From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Trevor Cordes <netfilter@tecnopolis.ca>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: expose named set element count
Date: Tue, 20 Oct 2026 18:35:28 +0200 [thread overview]
Message-ID: <ateYUFIPFZshosqX@chamomile> (raw)
In-Reply-To: <atdp-FBVOOKgN0De@pog.tecnopolis.ca>
On Tue, Oct 20, 2026 at 08:17:44AM -0500, Trevor Cordes wrote:
> Hi! I have an application that can create very large named sets
> (dynamically) of IPs. For monitoring and testing purposes it is useful to
> get a count of elements currently in a set.
>
> Currently I an running "nft list table inet mytable |wc". But once the ip
> set grows to much over 100k IPs, that command can take around 90 minutes
> on my system! During that time the nft command takes 98% CPU. That makes
> monitoring in this manner nearly impossible.
>
> I think the in-kernel code tracks the current number of elements. Can we
> expose this through the Netlink interface so users can get an instant
> count of elements with virtually 0 CPU usage? (Note, I'm not talking the
> "size" data point, I'm talking the actual IPs currently in the set.)
>
> Less importantly, I'm wondering what is making nft take so long to list
> these huge sets. Maybe the IP numeric sorting and formatting? If it's
> all the sorting, maybe an nft option to disable sorting would help? Or an
> option to disable formatting and have nft just dump the whole wad of IPs
> on one line per set?
>
> Thanks so much. Please CC: my on replies because I'm not sure my
> subscribe request is working or going anywhere. The listserv may not like
> my mail smarthost.
There is a count field in more recent userspace nft and kernels, what
nft and kernel versions are you running?
next prev parent reply other threads:[~2026-10-20 16:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 13:17 expose named set element count Trevor Cordes
2026-10-20 16:35 ` Pablo Neira Ayuso [this message]
2026-10-20 16:51 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ateYUFIPFZshosqX@chamomile \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@tecnopolis.ca \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox