From: Pablo Neira Ayuso <pablo@netfilter.org>
To: ѽ҉ᶬḳ℠ <vtol@gmx.net>
Cc: "netfilter@vger.kernel.org" <netfilter@vger.kernel.org>
Subject: Re: [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?
Date: Tue, 29 Sep 2020 16:52:15 +0200 [thread overview]
Message-ID: <20200929145215.GA12225@salvia> (raw)
In-Reply-To: <407b6fc3-1986-6453-9f68-a066b3ad1974@gmx.net>
On Tue, Sep 29, 2020 at 01:39:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings is
> not clear whether the 'limit rate' stanza applies as:
>
> * cummulutive limit (from any/all saddr) for the daddr within the given
> period
>
> or
>
> * assumes/implies limit selectively for each saddr within the given period
>
> If it is a cummulutive limit how to go about a limit per saddr? For example:
>
> icmpv6 type 128 ip6 saddr limit rate over 15/second burst 3 packets drop
>
> or
>
> icmpv6 type 128 { ip6 saddr limit rate over 15/second burst 3 packets } drop
This syntax is not correct.
Yesterday, you posted an example to combine limit rate with dynamic
sets which might be what you need.
Additionally, if you know how to use iptables, please have a look at
iptables -m limit, it's equivalent.
prev parent reply other threads:[~2020-09-29 14:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-29 13:39 [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr? ѽ҉ᶬḳ℠
2020-09-29 14:46 ` Florian Westphal
2020-09-29 16:13 ` ѽ҉ᶬḳ℠
2020-09-29 14:52 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200929145215.GA12225@salvia \
--to=pablo@netfilter.org \
--cc=netfilter@vger.kernel.org \
--cc=vtol@gmx.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox