STRUCT NFT_SET(9)

💅 struct nft_set — nf_tables set instance 👑

okay so real talk, this is the struct nft_set page out of the Kernel API Manual, and like... it's genuinely iconic?? this whole page is one big flex about the little set object that nf_tables builds everything on top of. bestie, grab a strawberry drink 🍓 and let's get into it, no cap.

---

✨ NAME ✨

struct nft_set — the nf_tables set instance 🎀 like, the actual thing, not the idea of the thing.

---

🦋 SYNOPSIS 🦋

here's the whole vibe, character for character, do not touch:

struct nft_set {
    struct list_head                list;
    struct list_head                bindings;
    refcount_t refs;
    struct nft_table                *table;
    possible_net_t net;
    char *name;
    u64 handle;
    u32 ktype;
    u32 dtype;
    u32 objtype;
    u32 size;
    u8 field_len[NFT_REG32_COUNT];
    u8 field_count;
    bool in_update_walk;
    u32 use;
    atomic_t nelems;
    u32 ndeact;
    u64 timeout;
    u32 gc_int;
    u16 policy;
    u16 udlen;
    unsigned char                   *udata;
    struct list_head                pending_update;
    const struct nft_set_ops        *ops;
    u16 flags:13, dead:1, genmask:2;
    u8 klen;
    u8 dlen;
    u8 num_exprs;
    struct nft_expr                 *exprs[NFT_SET_EXPR_MAX];
    struct list_head                catchall_list;
    unsigned char                   data[];
};

like... look at that. main character energy from top to bottom. 🌈

---

🌸 Members 🌸

every single one, in order, bestie — nothing skipped, that's the rule:

• list — table set list node. it's literally the little handle that hooks this set into its table's list 🫶
• bindings — list of set bindings. the friend group of things attached to this set.
• refs — internal refcounting for async set destruction 💀 yes, it keeps score so the set can go away asynchronously without anyone crying.
• table — table this set belongs to. its home base.
• net — netnamespace this set belongs to. which netns it reps.
• name — name of the set. its government name ✨
• handle — unique handle of the set. the one-of-one ID.
• ktype — key type (numeric type defined by userspace, not used in the kernel). yeah, that's the actual context, don't @ me.
• dtype — data type (verdict or numeric type defined by userspace).
• objtype — object type (see the NFT_OBJECT_* definitions 👀).
• size — maximum set size.
• field_len — length of each field in concatenation, bytes.
• field_count — number of concatenated fields in element.
• in_update_walk — true during ->walk in transaction phase. it's giving "currently mid-walk."
• use — number of rules references to this set.
• nelems — number of elements.
• ndeact — number of deactivated elements queued for removal 🗑️ queued up, not gone yet.
• timeout — default timeout value in jiffies.
• gc_int — garbage collection interval in msecs. the cleanup schedule, lowkey vital.
• policy — set parameterization (see enum nft_set_policies).
• udlen — user data length.
• udata — user data.
• pending_update — list of pending update set element. the "on my way" list 💅
• ops — set ops.
• flags — set flags.
• dead — set will be freed, never cleared. like, that's not a mood, that's a one-way door 🙈
• genmask — generation mask.
• klen — key length.
• dlen — data length.
• num_exprs — numbers of exprs.
• exprs — stateful expression.
• catchall_list — list of catch-all set element. catching everything, obviously.
• data — private set data.

---

🔥 SEE ALSO 🔥

the whole extended universe, bestie — every single reference, and yes the kernel file goes first:

• Kernel file ./include/net/netfilter/nf_tables.h
• struct nft_verdict(9)
• struct nft_regs(9)
• struct nft_ctx(9)
• struct nft_userdata(9)
• struct nft_set_elem(9)
• enum nft_iter_type(9)
• struct nft_set_desc(9)
• enum nft_set_class(9)
• struct nft_set_estimate(9)
• struct nft_expr(9)
• struct nft_set_ops(9)
• struct nft_set_type(9)
• struct nft_set_binding(9)
• enum nft_set_extensions(9)
• struct nft_set_ext_type(9)
• struct nft_set_ext_tmpl(9)
• struct nft_set_ext(9)
• struct nft_expr_type(9)
• struct nft_expr_ops(9)
• struct nft_rule(9)
• struct nft_chain_validate_state(9)
• struct nft_chain(9)
• struct nft_chain_type(9)
• struct nft_base_chain(9)
• struct nft_table(9)
• struct nft_object_hash_key(9)
• struct nft_object(9)
• struct nft_object_type(9)
• struct nft_object_ops(9)
• struct nft_flowtable(9)
• struct nft_traceinfo(9)
• struct nft_trans(9)
• struct nft_trans_hook(9)
• struct nft_trans_binding(9)

---

ok that's the whole page!! every field accounted for, zero skips, we ate and left no crumbs 💅

and finally, the cute little sign-off where the boring footer used to live: this one comes from ./include/net/netfilter, stamped October 2026, and it's filed under struct nft_set(9) — slay, bye bestie 🎀🦋✨