From 1af8f573012e2cbde19952a8728ae5f5597a874e Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Tue, 12 May 2026 15:17:42 +0200 Subject: [PATCH] docs: rewrite traffic events logging Limitations section (#744) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * docs: rewrite traffic events logging Limitations section The previous matrix mixed several inaccurate claims about feature availability across WireGuard modes. Replace it with the actual constraint — policy IDs and blocked events are only reported when the destination/routing peer is in userspace mode — plus the command Linux operators use to force userspace mode. Collapse the two duplicated inline notes in the Correlating events section into short pointers to Limitations so the constraint and command live in one canonical place. * Update src/pages/manage/activity/traffic-events-logging.mdx Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com> --------- Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com> --- .../activity/traffic-events-logging.mdx | 23 ++++++++----------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/src/pages/manage/activity/traffic-events-logging.mdx b/src/pages/manage/activity/traffic-events-logging.mdx index ffab9741..d690ae6b 100644 --- a/src/pages/manage/activity/traffic-events-logging.mdx +++ b/src/pages/manage/activity/traffic-events-logging.mdx @@ -267,8 +267,7 @@ Events can be correlated by observing the traffic from both peers involved in a you will see up to 4 events from these peers. If the connection was successful, you will see a started and a stopped event from Peer A and Peer B. But, if one peer blocks the connection, then you will see a started and stopped events from the initiator and a blocked event from the responder. - The blocked event will be available only if the destination uses the NetBird client in userspace mode. - This is the case for Windows and MacOs nodes. For Linux, you can enable userspace mode with the environment variable `NB_WG_KERNEL_DISABLED=true` and `NB_FORCE_USERSPACE_ROUTER=true` + Blocked events are only reported when the destination peer is in userspace mode. See [Limitations](#limitations). ### Viewing TCP and UDP connections @@ -309,8 +308,7 @@ Key differences: - There are no events that have started or stopped on the refusing side. The connection is blocked right after the request. - Depending on the application making a request in the initiator, you may see multiple blocked events from the receiving side of the connection due to retries: - The blocked event will be available only if the destination is using the NetBird client in userspace mode. - This is the case for Windows and MacOs nodes. For Linux, you can enable userspace mode with the environment variable `NB_WG_KERNEL_DISABLED=true` and `NB_FORCE_USERSPACE_ROUTER=true` + Blocked events are only reported when the destination peer is in userspace mode. See [Limitations](#limitations). ### Viewing ICMP connections @@ -343,16 +341,15 @@ For site-2-site connections, the events will be similar to the above examples, b

## Limitations -There are a few differences between the different WireGuard modes NetBird supports and the data captured by the NetBird client. -| Feature | Kernel Mode | Userspace Mode | Netstack Mode | -|:---------:|:-------------:|:----------------:|:---------------:| -| Blocked traffic event | No | Yes | Yes | -| Site-2-Site events | No | Yes | Yes | -| Rule IDs | No | Yes | Yes | -| Allowed rule ID for routed events | Yes | No | No | -| Byte counters for routed events | Yes | No | No | + +Policy IDs and blocked traffic events are not reported when the destination peer (or routing peer) is running in kernel mode. + -We are actively working to improve the data captured by the NetBird client in Kernel and userspace modes to align with customers' expectations. +On Linux, you can force a routing peer into userspace mode with three [environment variables](/client/environment-variables): + +```bash +sudo netbird service reconfigure --service-env NB_WG_KERNEL_DISABLED=true,NB_FORCE_USERSPACE_FIREWALL=true,NB_FORCE_USERSPACE_ROUTER=true +``` ## Conclusion Traffic events logging provides a powerful tool for monitoring and analyzing network traffic across your infrastructure.