nftables
E886826
nftables is a Linux kernel framework and user-space utility for packet filtering, network address translation (NAT), and firewall configuration, designed as the modern replacement for iptables within the Netfilter project.
All labels observed (1)
| Label | Occurrences |
|---|---|
| nftables canonical | 3 |
How this entity was disambiguated
This entity first appeared as the object of triple T10826884 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: nftables Context triple: [netfilter, hasComponent, nftables]
-
A.
netfilter
netfilter is a framework within the Linux kernel that provides packet filtering, network address translation (NAT), and other networking-related operations for implementing firewalls and traffic control.
-
B.
iptables
iptables is a widely used Linux userspace utility for configuring the kernel’s packet filtering and network address translation (NAT) firewall rules.
-
C.
IPFW firewall
IPFW firewall is a stateful packet filtering and traffic shaping firewall system used in FreeBSD for controlling and securing network traffic.
-
D.
Npcap
Npcap is a high-performance packet capture and network monitoring library for Windows, commonly used by tools like Wireshark for low-level network traffic analysis.
-
E.
BPF
BPF is the abbreviation for the British Pacific Fleet, a major Royal Navy formation that operated in the Pacific theater during the final stages of World War II.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: nftables Target entity description: nftables is a Linux kernel framework and user-space utility for packet filtering, network address translation (NAT), and firewall configuration, designed as the modern replacement for iptables within the Netfilter project.
-
A.
netfilter
netfilter is a framework within the Linux kernel that provides packet filtering, network address translation (NAT), and other networking-related operations for implementing firewalls and traffic control.
-
B.
iptables
iptables is a widely used Linux userspace utility for configuring the kernel’s packet filtering and network address translation (NAT) firewall rules.
-
C.
IPFW firewall
IPFW firewall is a stateful packet filtering and traffic shaping firewall system used in FreeBSD for controlling and securing network traffic.
-
D.
Npcap
Npcap is a high-performance packet capture and network monitoring library for Windows, commonly used by tools like Wireshark for low-level network traffic analysis.
-
E.
BPF
BPF is the abbreviation for the British Pacific Fleet, a major Royal Navy formation that operated in the Pacific theater during the final stages of World War II.
- F. None of above. chosen
Statements (70)
| Predicate | Object |
|---|---|
| instanceOf |
Linux firewall framework
ⓘ
Netfilter component ⓘ packet filtering framework ⓘ |
| category |
Linux security software
ⓘ
firewall software ⓘ networking software ⓘ |
| configurationFileExtension | .nft ⓘ |
| configurationLanguage | nftables ruleset language ⓘ |
| designGoal |
improve performance
ⓘ
provide more expressive rule syntax ⓘ reduce code duplication in kernel ⓘ replace legacy iptables framework ⓘ simplify firewall management ⓘ unify IPv4 IPv6 ARP and bridge filtering ⓘ |
| developedBy | Netfilter core team NERFINISHED ⓘ |
| developedInLanguage | C ⓘ |
| documentation |
Netfilter nftables wiki
NERFINISHED
ⓘ
nft man page ⓘ |
| firstAppearedIn | Linux kernel 3.13 NERFINISHED ⓘ |
| hasComponent |
nf_tables kernel subsystem
ⓘ
nft userspace utility ⓘ |
| hasFeature |
JSON output support
ⓘ
compatibility layer for iptables ⓘ concise rule syntax ⓘ flow offload via flowtables ⓘ interval sets ⓘ maps and verdict maps ⓘ per-rule and named counters ⓘ set-based matching ⓘ |
| homepage | https://www.netfilter.org/projects/nftables/ ⓘ |
| implements |
atomic rule updates
ⓘ
connection tracking integration ⓘ dynamic sets ⓘ named counters ⓘ rule set transactions ⓘ stateful packet inspection ⓘ verdict maps ⓘ |
| kernelInterface | nf_tables ⓘ |
| license | GPL NERFINISHED ⓘ |
| operatingSystem | Linux ⓘ |
| partOf |
Linux kernel networking subsystem
NERFINISHED
ⓘ
Netfilter project NERFINISHED ⓘ |
| replaces |
arptables
NERFINISHED
ⓘ
ebtables NERFINISHED ⓘ ip6tables NERFINISHED ⓘ iptables NERFINISHED ⓘ |
| stableSupportIn | Linux kernel 3.18 NERFINISHED ⓘ |
| supportsAbstraction |
chains
ⓘ
flowtables ⓘ maps ⓘ sets ⓘ stateful objects ⓘ tables ⓘ |
| supportsFunction |
logging
ⓘ
masquerading ⓘ network address translation ⓘ packet filtering ⓘ packet mangling ⓘ port forwarding ⓘ rate limiting ⓘ stateful firewalling ⓘ traffic classification ⓘ |
| supportsProtocolFamily |
ARP
ⓘ
IPv4 ⓘ IPv6 ⓘ bridge ⓘ inet ⓘ netdev ⓘ |
| userSpaceTool | nft ⓘ |
| usesBackend | BPF for packet matching (optional) ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: nftables Description of subject: nftables is a Linux kernel framework and user-space utility for packet filtering, network address translation (NAT), and firewall configuration, designed as the modern replacement for iptables within the Netfilter project.
Referenced by (3)
Full triples — surface form annotated when it differs from this entity's canonical label.