iptables vs nftables Performance

Measured drop rates for iptables and nftables under packet floods: conntrack costs, hook placement, and where netfilter’s ceiling actually sits.