Phil Sutter <phil@xxxxxx> wrote: > Oh, I didn't get that. Does it work with removed interfaces? 'nft > monitor' will notice, but fetching hooks for the removed interface won't > return anything then, right? Yes, it won't find the interface since its already gone. One solution is to remember which interfaces had hooks and then just inform the user that the interface is going away. If a kernel implementation is small enough, then fine but I don't really see why its needed.