Why is the iptables byte count for raw PREROUTING 0?

I have been able to reproduce zeros in the counters on the first run of iptables --list --verbose -t raw. And the reason in my case simply was that the iptable_raw had not been loaded until I ran the command.

Since I don't need the raw table in my setup that module is usually not loaded, and it wasn't until I ran that command, that the module was loaded.

By running rmmod iptable_raw I can unload the module, and the next time I run iptables --list --verbose -t raw the counters have reset to zero.

That is all working as intended. And I guess that is the same which happened to you. If you create rules in the raw table the module will be automatically loaded, and if you don't need any rules in that table, there is no need to load the module.

For listing current rules I recommend using iptables-save which will output the rules in a format that can be loaded back with iptables-restore. It will show all the relevant details of your current rules, and it will not load any additional modules, it will show just those which are currently loaded.

The delay the first time you ran the command could be explained by a number of different reasons, it is hard to say exactly which one was the case for you. But one possibility is that the disk which the module needed to be loaded from had been spun down while idle and you needed to wait for that disk to spin up.