and ebtables
</li>
<li>
- All require a specific kernel module for each type of match
- and each possible action
+ All limited to single protocol, and need a kernel module for
+ each match type and each action
</li>
<li>
- Userland could only use the four protocol-specific APIs,
- although the internal netfilter API is more flexible
+ Kernel's internal netfilter API is more flexible
</li>
<li>
nftables exposes more of this flexibility, allowing userland
nftables userland tool uses this API and is already packaged
</li>
<li>
- Eventually, the old APIs will be removed and the old userland
+ Eventually, old APIs will be removed and old userland
tools must be ported to use nftables
</li>
</ul>