Re:recent module --hitcount problem

[Sudheer Divakaran <sudheer@svw.com>]

> 
> Hi,
> 
> Is there anything wrong with these commands?.  It seems that the recent 
> module (0.3.1) is not considering  the '--hitcount 10' attribute if the 
> machine is running for a long time (in the long run).  But when I tested 
> these rules from another machine, it worked properly.  But on the live 
> server, iptables blocks hosts if they attempted to access the SMTP port 
> within 60 seconds for a second time.
> 
> IPT=/sbin/iptables
> 
> $IPT -N SMTP_HAMMER
> $IPT -N CHECK_SMTP
> 
> 
> $IPT -A SMTP_HAMMER -j LOG --log-level debug
> $IPT -A SMTP_HAMMER -m recent --set --name hammer -j DROP
> 
> $IPT -A CHECK_SMTP    -m recent     --rcheck --seconds 480 --name hammer 
>    -j DROP
> $IPT -A CHECK_SMTP    -m recent     --rcheck --seconds 60  --hitcount 
> 10     -j SMTP_HAMMER
> $IPT -A CHECK_SMTP    -m recent     --update                      
>           -j ACCEPT
> $IPT -A CHECK_SMTP    -m recent     --set                          
>          -j ACCEPT
> 
> 
> $IPT -A INPUT -i $WAN_IFACE    -p tcp --dport 25 -m state --state NEW  -j CHECK_SMTP
> 
> <.... Other rulles follows ..>


> --
> 
> Thanks
> Sudheer
> 
> 
> 
> 

Hi All,
	When I rebooted the machine, the server is working fine.  I have also 
noticed that when the recent module behaves unexpectedly, it just adds 
one 'last_pkts' entry to the file /proc/net/ipt_recent/DEFAULT for each 
host even though there should be more entries (i.e, if the hosts are 
connecting for more than one time).


Has anybody experienced it?. So this should be a bug???

--
Thanks
Sudheer