<p>I used to be able to do iptables debugging on a Debian 9 host with specific rules in chains <code>PREROUTING</code> and <code>OUTPUT</code> (both in table <code>raw</code>) and target <code>TRACE</code> and as described <a href="https://backreference.org/2010/06/11/iptables-debugging/" rel="nofollow noreferrer">here</a>. Messages showed up in <code>/var/log/kern.log</code> when such rules fired.</p>
<p>The host had the following relevant entries in its <a href="https://stackoverflow.com/questions/14587251/understanding-boot-config-file">boot config</a> file. Things apparently worked without either <code>CONFIG_IP_NF_TARGET_LOG</code> or <code>CONFIG_IP6_NF_TARGET_LOG</code>. (I am interested in IPv4 traffic.)</p>
<pre><code>CONFIG_NETFILTER_XT_TARGET_TRACE=m
CONFIG_IP_NF_RAW=m
CONFIG_IP6_NF_RAW=m
# CONFIG_IP_NF_TARGET_LOG missing
# CONFIG_IP6_NF_TARGET_LOG missing
CONFIG_NETFILTER_XT_TARGET_LOG=m
</code></pre>
<p>I have by now upgraded the same host to Debian 10 (Buster). It uses <code>iptables-legacy</code> (not the default <code>iptables-nft</code>), for this is in the context of a Kubernetes cluster.</p>
<p>What I am observing is that the same rules (e.g. <code>iptables -t raw -A PREROUTING -d $service_ip -p tcp -j TRACE</code>; also the same with <code>$pod_ip</code>) are apparently no longer working in the sense in that I do not see any resulting messages in <code>/var/log/kern.log</code>.</p>
<p>What could be the reason why and how can I further diagnose? It is perhaps the case that the <code>TRACE</code> capability requires a different boot config (different modules) with Debian 10, or does <code>iptables-legacy</code> now hinder somehow?</p>

rookie099
<p>Now it looks as if this kind of iptables debugging does in fact still work under Debian 10 as it did previously for me under Debian 9.</p>
<p>Apparently I had made a mistake by installing rules for iptables debugging before recreating targeted Kubernetes <code>service</code>s, etc. That way the iptable rules and Kubernetes resources were out of sync with respect to cluster IPs, node ports, pod IPs, etc., and so the rules never fired with traffic to those <code>service</code>s, etc.</p>
