NFT400 - Invalid Response From nft

Agent error code #NFT400 indicates that nft ran and returned output the agent could not parse. The agent reads the ruleset in JSON form (nft -j list sets), and the response did not match the structure it expects.

Common causes include:

• The installed nft is too old to support JSON output, or produces a different JSON schema
• A wrapper script named nft is on the PATH ahead of the real binary and is adding output of its own
• The command was truncated, for example by a timeout partway through a large ruleset
• Output from another program is being interleaved into the response

Steps to Resolve

Check the nft Version and JSON Support

1. Run nft --version
2. Confirm the JSON output parses: sudo nft -j list sets | head
3. If the command errors on -j, the build lacks JSON support and needs upgrading

Confirm You Are Running the Real Binary

1. Run command -v nft and confirm it points at the system binary, normally /usr/sbin/nft
2. A wrapper that prints a banner or a warning line corrupts the JSON the agent reads

Look for a Timeout on a Large Ruleset

Every command Knocknoc runs has a time limit. On a host with a very large ruleset the listing can be cut short, which presents as unparseable output. The agent log records the raw response alongside this code.

Check the Agent Log

The full nft output is written to the agent log and never to this message. Inspect the log entry recorded with the failed operation to see what was actually returned.