From the nftables Quick reference:
family refers to a one of the following table types: ip, arp, ip6, bridge, inet, netdev.
type refers to the kind of chain to be created. Possible types are:
filter: Supported by arp, bridge, ip, ip6 and inet table families.
route: Mark packets (like mangle for the output hook, for other hooks use the type filter instead), supported by ip and ip6.
nat: In order to perform Network Address Translation, supported by ip and ip6.
The possible chain types are:
filter, which is used to filter packets. This is supported by the arp, bridge, ip, ip6 and inet table families.
route, which is used to reroute packets if any relevant IP header field or the packet mark is modified. If you are familiar with iptables, this chain type provides equivalent semantics to the mangle table but only for the output hook (for other hooks use type filter instead). This is supported by the ip, ip6 and inet table families.
nat, which is used to perform Networking Address Translation (NAT). Only the first packet of a given flow hits this chain; subsequent packets bypass it. Therefore, never use this chain for filtering. The nat chain type is supported by the ip, ip6 and inet table families.
Hence, according to at least two authoritative references, no chain type is supported by the
netdev family. Given that, how can we use the
netdev family at all?