Repository navigation
Count IPv6 traffic in virtual router network usage #14591
Description
On isolated and VPC networks, the virtual router only supports counters using iptables, therefore only counts IPv4 traffic for network usage, as IPv6 traffic uses nftables.
If a network has IPv6 enabled, VMs can send as much IPv6 traffic as they like and none of it shows up in usage.
Shared networks already count IPv6. They take usage from the libvirt stats on each VM's NIC. Those stats also pick up traffic between VMs on the same network, plus DHCP, ARP and ND.
It would be good to have routers count IPv6 too. That way, usage on a dual-stack network covers all of a VM's traffic.
This came up while working on #14578.
#14583 introduced configuration to accept IPv6 entries in network.usage.exempt.cidrs to support exemptions for Shared networks, but routers can't use them until they count IPv6.
Activity
github-actions commentedon Nov 6, 2026
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
🎯 Triage report
On isolated and VPC networks, the virtual router counts only IPv4 traffic for network usage, because its counters use iptables while IPv6 goes through nftables. A dual-stack network therefore under-reports usage. Shared networks already count IPv6 via libvirt NIC stats. The reporter proposes that routers count IPv6 too, so usage is consistent. This is linked to #14578 and to the IPv6 exemption config added in #14583.
📊 Assessment
🔗 Similar issues
💡 Notes and suggestions
network.usage.exempt.cidrsIPv6 entries. Maintainers may want to confirm whether routers should count IPv6 before the exemption list is used for VR networks.Add this agentic workflow to your repo
To install this agentic workflow, run
weizhouapache commentedon Nov 6, 2026
as I remember, the nftables rules also have some counters