List iptables Rules with Packet Counters
Dump every firewall rule with DNS-free numeric output, byte counters, and rule numbers — read-only inspection that never touches the ruleset.
Run sudo iptables -L -n -v --line-numbers to list all chains with rule numbers and packet/byte hit counters, or -t nat -L -n -v for the NAT table.
01Command
Command
$ sudo iptables -L -n -v --line-numbers02What it does
-L lists the rules, -n skips reverse DNS lookups (which otherwise make listing painfully slow and leak query logs), and -v adds the packet and byte counters that reveal which rules actually match traffic. --line-numbers prefixes each rule with the number needed by -I or -D. Listing is completely read-only — safe on a production firewall where a mistyped flush would be catastrophic.
03Risk
!Warning: A rule with zero packets may be unreachable because an earlier rule shadows it — check counters, not just rule order, when debugging.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- iptables(8) — Linux manual pageEvidence: iptables man page: '-L, --list [chain] List all rules' with -n (numeric output), -v (verbose packet/byte counters) and --line-numbers.
Last verified: 2026-09-17 · Category: Security & Privacy