Re: limit module timer precision issue

["Michal Kubeček" <mkubecek@suse.cz>]

On Thursday 13 of October 2011, abirvalg@lavabit.com wrote:
> Hi, it seems to me that limit module has issues with timer precision.
> The only iptables rules i have are:
> 
> iptables  -I OUTPUT 1 -m state --state NEW -m limit --limit 2000/sec
> --limit-burst 1  -j NFQUEUE --queue-num 11220 iptables -I OUTPUT 2
> -m state --state NEW -j NFQUEUE --queue-num 11222
> 
> iptables  -I INPUT 1 -m state --state NEW -m limit --limit 2000/sec
> --limit-burst  1 -j NFQUEUE --queue-num 11221 iptables -I INPUT 2 -m
> state --state NEW -j NFQUEUE --queue-num 11222
> 
> (Both NFQUEUE 11220 and 11221 pass only NF_ACCEPT or NF_DROP
> verdicts.)
> 
> If I understand -m limit correctly, only if there is more than 2000
> NEW connections going in or out, NFQUEUE 11222 will trigger.

Not exactly. With "--limit-burst 1", no more than one packet per jiffy 
can pass the test. You may have only 30 NEW packets per second but it 
doesn't mean one packet every 1/30 s. And if there are two (or more) NEW 
packets within one jiffy, only the first passes the first rule.

Increasing the value of --limit-burst should help.

                                                         Michal Kubeèek