Florian Westphal <fw@xxxxxxxxx> wrote: > Might be a bug in ebtables. This is what nft monitor shows: > > add chain bridge filter INPUT { type filter hook input priority filter; > policy accept; } > add rule bridge filter INPUT ether saddr . ip saddr { > 08:00:27:40:f7:09 . > 192.168.56.10-0x1297286e2b2 [..] nft monitor calls interval_map_decompose() even though it should not in this case. After fix this shows: add rule bridge filter INPUT ether saddr . ip saddr { 08:00:27:40:f7:09 . 192.168.56.10, 08:00:27:40:f7:09 . 192.168.56.10 } counter ... instead, which looks correct (even though the concat range is technically not required in this case).