On Mon, 27 May 2024 13:17:50 +0300 Teodor Milkov wrote: > I just tried putting log before counter and still nothing showing in > logs. But does order really matter? Perhaps not. I just thought it might be worth trying. What happens if you remove the counter and use only log? I tried this: table netdev xxx { chain ingress { type filter hook ingress device "eth0" priority -600 counter log prefix "TEST: " drop } } and I ran 'arp' on the other end of the eth0 link. I can see logging works, i.e. without specifying any particular protocol whatsoever. Counter works too.