All of lore.kernel.org
 help / color / mirror / Atom feed
From: raptor <raptor@tvskat.net>
To: lartc@vger.kernel.org
Subject: [LARTC] floods
Date: Fri, 12 Sep 2003 13:36:01 +0000	[thread overview]
Message-ID: <marc-lartc-106337447921972@msgid-missing> (raw)

after the recent outbreak of Welchia and winblaster, i was wondering of a way to block Flooding of pings or such activity...
My question is what u do to block such floods automaticaly per IP...what I mean.
Example I'm aware that I don't want to allow any concentrate IP host/address to send to me more than 3 icmp request per second.
The question is it possible with iptables rules to automaticly detect such HOSTs and ban it... currently i use  "-m limit", but this
limits the total number of request... what I need is aproximatly this (perl pseudo code below):

for $ip (every IP that tries to ping) {
  $count{$ip}++;
  -j DROP if $count{$ip} > $limit;
}

mind u, it is not nececary to be icmp it can be something else..
In fact -m limit can do this if I have rules for all offending addresses.. but the problem is that i don't know them in advance i.e.
iptables has to do this classification for me...


any idea ?
tia

ps. afaik i think i saw something like this, but cant remember where...
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

                 reply	other threads:[~2003-09-12 13:36 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-106337447921972@msgid-missing \
    --to=raptor@tvskat.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.