A rule allowing a port from a specific address, for a service that had been containerised and moved two years earlier.
$ nft list ruleset | grep -c 'tcp dport'
14
$ for p in $(nft list ruleset | grep -oP 'tcp dport Kd+'); do
ss -lntp "sport = :$p" | tail -n +2 | head -1 || echo "$p: nothing listening"
done
6379: nothing listening
9200: nothing listening
...
# 4 of 14 rules allow traffic to ports with no listener.
A rule allowing traffic to a closed port is harmless today and is a rule that becomes wrong the moment something else binds that port. Cross-referencing the ruleset against what is actually listening is one loop and finds the drift, and it belongs in the same quarterly pass as the certificate scan.