As of 0.9.8 the icmp type is marked as a protocol field, so its elided in 'nft monitor trace' output: icmp code 0 icmp id 44380 .. Restore it. Unlike tcp, where 'tcp sport' et. al in the dump will make the 'ip protocol tcp' redundant this case isn't obvious in the icmp case: icmp type 8 code 0 id ... Reported-by: Martin Gignac <martin.gignac@xxxxxxxxx> Fixes: 98b871512c4677 ("src: add auto-dependencies for ipv4 icmp") Signed-off-by: Florian Westphal <fw@xxxxxxxxx> --- src/netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/netlink.c b/src/netlink.c index ec2dad29ace1..c3887d5b6662 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -1859,7 +1859,9 @@ next: pctx->pbase == PROTO_BASE_INVALID) { payload_dependency_store(pctx, stmt, base - stacked); } else { - payload_dependency_kill(pctx, lhs, ctx->family); + /* Don't strip 'icmp type' from payload dump. */ + if (pctx->icmp_type == 0) + payload_dependency_kill(pctx, lhs, ctx->family); if (lhs->flags & EXPR_F_PROTOCOL) payload_dependency_store(pctx, stmt, base - stacked); } -- 2.26.2