netst: use iptable -S, only do ovs-vsctl show once (not per ns)