* stateful tracking options
@ 2007-11-27 21:28 Quartexx
2007-11-27 22:39 ` Grant Taylor
0 siblings, 1 reply; 2+ messages in thread
From: Quartexx @ 2007-11-27 21:28 UTC (permalink / raw)
To: netfilter
hi
is possible to use stateful tracking options?
I mean set limits related to filter rules that create state entries;
for example: limit the number of source IP addresses that can
simultaneously create state, or limit the rate of new connections to a
certain amount per time interval.
thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: stateful tracking options
2007-11-27 21:28 stateful tracking options Quartexx
@ 2007-11-27 22:39 ` Grant Taylor
0 siblings, 0 replies; 2+ messages in thread
From: Grant Taylor @ 2007-11-27 22:39 UTC (permalink / raw)
To: Mail List - Netfilter
On 11/27/07 15:28, Quartexx wrote:
> is possible to use stateful tracking options?
Yes
> I mean set limits related to filter rules that create state entries;
>
> for example: limit the number of source IP addresses that can
> simultaneously create state, or limit the rate of new connections to
> a certain amount per time interval.
I'd say that you could do something with the recent match extension /
target. This would allow you to do some things in conjunction to
whether or not a given source ip address in in a given recent list (you
can have multiple) or not in a (user) specified amount of time.
You would end up checking a recent list to see if the given source
qualifies to alter state or not.
Grant. . . .
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-11-27 22:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-11-27 21:28 stateful tracking options Quartexx
2007-11-27 22:39 ` Grant Taylor
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox