NetFilter
[Top] [All Lists]

ULOG with hashlimit not working as expected

To: netfilter@lists.netfilter.org, netfilter-devel@lists.netfilter.org
Subject: ULOG with hashlimit not working as expected
From: Retesh <retesh.chadha@gmail.com>
Date: Thu, 25 Jan 2007 11:39:44 +0530
Cc:
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=e3ffq3Tr++k6kHhTE5Ihk/7z3HNciq2JosBF9BKuC3iii1qpjL7LwiFsaT/DsNKrVWMxOayULg9K6NiR/2F6ut7CstvwoNRK4ir7q1g5EOv3EvsfWMvZff/4IU9poOnfiUHEs3vq/3BOd1DO/66C2wzBmyChiurm0GNTKnXR0Go=
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Sender: netfilter-bounces@lists.netfilter.org
Hi All
I am facing a issue with ULOG along with hashlimit, where hashlimit is
not working as expected.

I have rules as follows

1. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit
100/s --hashlimitname foo1 -j ACCEPT
2. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit
200/s --hashlimitname foo2 -j DROP
3. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit
1/min --hashlimitname foo3 -j ULOG
4. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit
1/min --hashlimitname foo4 -j LOG
5. iptables -A INPUT -j DROP

Here I have noticed that hashlimit of 1/min is not working, even
though the hashlimits of 1st 2 rules is working fine. What is
happening is that I am bombarding the system from a source endpoint in
SET1, with 300/s.
My expectation is that 100 packets will be accepted (1), another 100
will be dropped (2), and rest all will be dropped with ULOG/LOG
happening 1 per minutes (3,4,5). But ULOG is not happening at 1/min.
What i see is that if say I bombard for 90 seconds at the rate of
300/s, ULOG/LOG messages that are generated are 11.

Anyone aware if this is a  limitation of hashlimit or am I missing
something here.

Thanks in advance

With Regards
Retesh Chadha


<Prev in Thread] Current Thread [Next in Thread>
  • ULOG with hashlimit not working as expected, Retesh <=