| To: | netfilter@lists.netfilter.org, netfilter-devel@lists.netfilter.org |
|---|---|
| Subject: | ULOG with hashlimit not working as expected |
| From: | Retesh <retesh.chadha@gmail.com> |
| Date: | Thu, 25 Jan 2007 11:39:44 +0530 |
| Cc: | |
| Delivered-to: | sp-com-lists@consult.net |
| Delivered-to: | netfilter-list1@securepoint.com |
| Domainkey-signature: | a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=e3ffq3Tr++k6kHhTE5Ihk/7z3HNciq2JosBF9BKuC3iii1qpjL7LwiFsaT/DsNKrVWMxOayULg9K6NiR/2F6ut7CstvwoNRK4ir7q1g5EOv3EvsfWMvZff/4IU9poOnfiUHEs3vq/3BOd1DO/66C2wzBmyChiurm0GNTKnXR0Go= |
| List-archive: | </pipermail/netfilter> |
| List-help: | <mailto:netfilter-request@lists.netfilter.org?subject=help> |
| List-id: | General discussion and user questions <netfilter.lists.netfilter.org> |
| List-post: | <mailto:netfilter@lists.netfilter.org> |
| List-subscribe: | <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe> |
| List-unsubscribe: | <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe> |
| Sender: | netfilter-bounces@lists.netfilter.org |
Hi All I am facing a issue with ULOG along with hashlimit, where hashlimit is not working as expected. I have rules as follows 1. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit 100/s --hashlimitname foo1 -j ACCEPT 2. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit 200/s --hashlimitname foo2 -j DROP 3. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit 1/min --hashlimitname foo3 -j ULOG 4. iptables -A INPUT -m set --set SET1 src -m hashlimit --hashlimit 1/min --hashlimitname foo4 -j LOG 5. iptables -A INPUT -j DROP Here I have noticed that hashlimit of 1/min is not working, even though the hashlimits of 1st 2 rules is working fine. What is happening is that I am bombarding the system from a source endpoint in SET1, with 300/s. My expectation is that 100 packets will be accepted (1), another 100 will be dropped (2), and rest all will be dropped with ULOG/LOG happening 1 per minutes (3,4,5). But ULOG is not happening at 1/min. What i see is that if say I bombard for 90 seconds at the rate of 300/s, ULOG/LOG messages that are generated are 11. Anyone aware if this is a limitation of hashlimit or am I missing something here. Thanks in advance With Regards Retesh Chadha |
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Pid owner module, Jorge Davila |
|---|---|
| Next by Date: | owner-Match in 2.6.20-rc5, Sebastian Claßen |
| Previous by Thread: | Dropped fin acks (iptables + lvs), Patrik Karén |
| Next by Thread: | owner-Match in 2.6.20-rc5, Sebastian Claßen |
| Indexes: | [Date] [Thread] [Top] [All Lists] |