Hi Near CONNTRACK EXPRESSIONS at manual I think that should be good to insert something like: ct {state | direction | status | mark | expiration | helper | label} .... ct count [over] <------- and just a little bellow it has already an example of it. ... filter input tcp dport 22 meter test { ip saddr ct count over 2 } reject Maybe a include at Table 55. Conntrack expressions too ??? <---- Could it be inserted at https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes#Ct ??? best regards -- Paulo Ricardo Bruck consultor