* [PATCH nft] doc: ct count should be restricted via new
@ 2026-04-09 11:57 Florian Westphal
2026-04-09 15:12 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2026-04-09 11:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Not doing it will affect existing flows, which is likely not wanted.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
doc/payload-expression.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index 8b538968c84b..817b7a3c76b1 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -934,5 +934,5 @@ ct_id|
.restrict the number of parallel connections to a server
--------------------
nft add set filter ssh_flood '{ type ipv4_addr; flags dynamic; }'
-nft add rule filter input tcp dport 22 add @ssh_flood '{ ip saddr ct count over 2 }' reject
+nft add rule filter input ct state new tcp dport 22 add @ssh_flood '{ ip saddr ct count over 2 }' reject
--------------------
--
2.52.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nft] doc: ct count should be restricted via new
2026-04-09 11:57 [PATCH nft] doc: ct count should be restricted via new Florian Westphal
@ 2026-04-09 15:12 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-09 15:12 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Thu, Apr 09, 2026 at 01:57:53PM +0200, Florian Westphal wrote:
> Not doing it will affect existing flows, which is likely not wanted.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> doc/payload-expression.txt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index 8b538968c84b..817b7a3c76b1 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt
> @@ -934,5 +934,5 @@ ct_id|
> .restrict the number of parallel connections to a server
> --------------------
> nft add set filter ssh_flood '{ type ipv4_addr; flags dynamic; }'
> -nft add rule filter input tcp dport 22 add @ssh_flood '{ ip saddr ct count over 2 }' reject
> +nft add rule filter input ct state new tcp dport 22 add @ssh_flood '{ ip saddr ct count over 2 }' reject
> --------------------
> --
> 2.52.0
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-09 15:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09 11:57 [PATCH nft] doc: ct count should be restricted via new Florian Westphal
2026-04-09 15:12 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox