Trace, stats and metrics see what the rules decide.

Stats

$ moat stats --iface eth0 [--watch | --json]

Packets and bytes for every rule, in rule order, then the default action. In audit mode, rules that drop show as "would drop"; --watch follows audit being turned on or off.

Variables

$ moat var list --iface eth0 [--json]

The current value of every variable on the running program.

Trace

$ moat trace --iface eth0 [--rule NAME] [--count N] [-w FILE]

Prints the packets a rule (or every rule) decides, one line each, or writes them to a pcap file with -w. The program sends the first 128 bytes of each matching frame only while a trace runs. Only one trace per interface runs at a time; if moat trace is killed, tracing stays on until moat trace --off or a reload. When the rules are reloaded or unloaded under a running trace, it ends with "the rules on eth0 were reloaded or unloaded; run moat trace again to follow the new program".

Metrics

$ moat metrics [--iface eth0] [--listen 127.0.0.1:PORT]

moat metrics prints what every interface with rules loaded holds, in the Prometheus text format; --iface limits it to one interface. Write it to a file node_exporter's textfile collector reads, or serve it with --listen, which answers on /metrics until interrupted.