Re: [nftables] netdev rate limiting | timeouts rfq

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Sep 28, 2020 at 01:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
> > On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > In the below example it does not print any logs and since that stanza is
> > > right prior drop I reckon that since the log printing does not happen the
> > > frame dropping does neither.
> > > 
> > > table inet filter {
> > [...]
> > >          chain wan_pr {
> > >                  ct state { new } update @glv4 { ip saddr limit rate over
> > > 15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
> > >          }
> > > }
> > ct state new is restricting to match only on the first packet of the
> > connection.
> 
> Right, it should be then rather something with ct count, like:
> 
> ct state new update @glv4 { ip saddr ct count over 15 } log flags all prefix
> "glv4 DROP: " drop
> 
> but that produces:
> 
> Error: Could not process rule: Not supported

What would you like to achieve in first place?

This thread is starting to diverge from the original question.