From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Sebastian 'spax' Pape" Date: Mon, 01 Jul 2002 17:51:06 +0000 Subject: Re: [LARTC] Hammer protection Message-Id: List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org hi Joachim, > I want to deny a user who has just logged off .. for about > 10seconds. I think you can only limit the number of syn-pakets like you already proposed. > I tried with this, but that didn't work. Maybe my mind is going > completely in the wrong direction today? =) > > iptables -I INPUT -i eth0 -p tcp -s 0/0 -d $my_ip --dport 21 -m > limit --limit 10/second --limit-burst 1 --tcp-flags ALL SYN -j > ACCEPT I'm not sure, but I think you just mixed the parameters up. --limit 10/second allows 10 SYN pakets per second so if you only want one paket per 10 seconds you should perhaps try 6/minute or maybe say 1/minute and set the limit-bust to 3 or so. best regards Sebastian -- Sebastian 'spax' Pape | I'm like time ... u can't stop me! mailto: sebastian@p-a-p-e.de | gpg: http://p-a-p-e.de/gpg.asc | --- Do you want to know more? http://www.p-a-p-e.de/ --- _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/