Please explain the limit match

Please explain the limit match

[Michael Klinteberg]

I have read the man page over and over again for the iptables limit
match. Don't quite understad the --limit and --limit-burst.

Can anyone please give me some easy LOGing examples with diffrent
time-intervalls.

-- 
Thank you
Michael K

Please explain the limit match

[Michael Klinteberg]

I have read the man page over and over again for the iptables limit
match. Don't quite understad the --limit and --limit-burst.

Can anyone please give me some easy LOGing examples with diffrent
time-intervalls.

-- 
Thank you
Michael K

Re: Please explain the limit match

[Alexis]

suppose a limit for pings with limit=1/s and limit burst=5

first 5 pings will pass, then, if you have a 2s timeout with the ping, youll
get 3 of 5 pings

this is first you need to "full" the burst counter, then if no activity is
received the burst will start to decrease until a new unit could match.

did you saw this?

http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html#ss7.3




----- Original Message ----- 
From: "Michael Klinteberg" <micke@klintan.se>
To: <netfilter@lists.netfilter.org>
Sent: Sunday, February 01, 2004 6:12 PM
Subject: Please explain the limit match


> I have read the man page over and over again for the iptables limit
> match. Don't quite understad the --limit and --limit-burst.
>
> Can anyone please give me some easy LOGing examples with diffrent
> time-intervalls.
>
> -- 
> Thank you
> Michael K
>
>

Re: Please explain the limit match

[Robert P. J. Day]

On Sun, 1 Feb 2004, Michael Klinteberg wrote:

> I have read the man page over and over again for the iptables limit
> match. Don't quite understad the --limit and --limit-burst.
> 
> Can anyone please give me some easy LOGing examples with diffrent
> time-intervalls.

  i remember, once upon a time, trying to figure this out and becoming
hopelessly confused by an overly-complicated explanation.  once i
discarded the verbiage, it seemed quite simple.

  think of starting with a collection of tokens that you use to pay
for packets.  if packets come in quickly, you'll quickly run out of 
tokens, and on a *regular* basis, you're given a token to replenish
your supply.

  as an example, let's say you define a limit of 5/sec, and a limit
burst of 10.  this means (and please correct me if i'm wrong), you start
with 10 tokens, and that's the *maximum* you'll ever be allowed to hold.

  every time a packet comes in that matches your criteria, if you want to
accept it, you have to pay a token.  based on your limit, you'll be 
replenished at the rate of 5/sec, or one every 0.2 seconds.

  if you get no packets, you'll just sit there, hoarding your 10 tokens.
if, suddenly, you get a flurry of activity (DoS attack), you'll spend your
10 tokens almost immediately, and then will have to reject further 
packets, except that every 0.2 seconds, you'll get another token, which
you'll spend immediately as long as you have heavy incoming traffic.

  only when the traffic dies off will you get a breather and a chance to
replenish your supply of tokens again, one every 0.2 seconds in your case.
i did, in fact, test this with logging and it matches what i described 
here.  others use an analogy of balls in a bucket, etc.

rday

Re: Please explain the limit match

[Michael Klinteberg]

On Sun, 1 Feb 2004 16:51:43 -0500 (EST)
"Robert P. J. Day" <rpjday@mindspring.com> wrote:

> 
> 
> On Sun, 1 Feb 2004, Michael Klinteberg wrote:
> 
> > I have read the man page over and over again for the iptables limit
> > match. Don't quite understad the --limit and --limit-burst.
> > 
> > Can anyone please give me some easy LOGing examples with diffrent
> > time-intervalls.
> 
>   i remember, once upon a time, trying to figure this out and becoming
> hopelessly confused by an overly-complicated explanation.  once i
> discarded the verbiage, it seemed quite simple.
> 
>   think of starting with a collection of tokens that you use to pay
> for packets.  if packets come in quickly, you'll quickly run out of 
> tokens, and on a *regular* basis, you're given a token to replenish
> your supply.
> 
>   as an example, let's say you define a limit of 5/sec, and a limit
> burst of 10.  this means (and please correct me if i'm wrong), you
> start with 10 tokens, and that's the *maximum* you'll ever be allowed
> to hold.
> 
>   every time a packet comes in that matches your criteria, if you want
>   to
> accept it, you have to pay a token.  based on your limit, you'll be 
> replenished at the rate of 5/sec, or one every 0.2 seconds.
> 
>   if you get no packets, you'll just sit there, hoarding your 10
>   tokens.
> if, suddenly, you get a flurry of activity (DoS attack), you'll spend
> your 10 tokens almost immediately, and then will have to reject
> further packets, except that every 0.2 seconds, you'll get another
> token, which you'll spend immediately as long as you have heavy
> incoming traffic.
> 
>   only when the traffic dies off will you get a breather and a chance
>   to
> replenish your supply of tokens again, one every 0.2 seconds in your
> case. i did, in fact, test this with logging and it matches what i
> described here.  others use an analogy of balls in a bucket, etc.
> 
> rday
> 
Thank you rday for your good explaining, it seems clearer now.

-- 
Michael K

Re: Please explain the limit match

[Michael Klinteberg]

On Sun, 1 Feb 2004 18:28:22 -0300
"Alexis" <alexis@attla.net.ar> wrote:

> suppose a limit for pings with limit=1/s and limit burst=5
> 
> first 5 pings will pass, then, if you have a 2s timeout with the ping,
> youll get 3 of 5 pings
> 
> this is first you need to "full" the burst counter, then if no
> activity is received the burst will start to decrease until a new unit
> could match.
> 
> did you saw this?
> 
> http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html#ss7.3
> 
Thank you for reminding me of the link. It was helpful.


-- 
Michael K