**Summary**
The show firewall command displays Packets and Bytes counters that reflect nftables rule match statistics, not per-connection or per-session traffic volume. This behavior is technically correct.
However, the current column headings do not clearly indicate that these counters apply only to packets and bytes that matched the rule. As a result, the output can be interpreted as showing total traffic for a connection or session.
**Summary**
Clarify the column headings to better reflect their meaning, for example:
- “Matched packets” / “Matched bytes”
- or “Rule hits (packets)” / “Rule hits (bytes)”