rate limit by MAC

rate limit by MAC

[Самусенко Андрей]

Hi!

Can iptables limit rate by MAC? Think it no.

What on Linux can do how i need?

Re: rate limit by MAC

[Richard Horton]

2009/7/1 Самусенко Андрей <samusenko@msm.ru>:
> Hi!
>
> Can iptables limit rate by MAC? Think it no.
>
> What on Linux can do how i need?
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

You might be able to...

iptables -A FORWARD -m mac --mac-source <<mac address>> -m limit
--limit 100/s -j ACCEPT would restrict the given mac address to 100
packets per second... but depending on how many mac addresses you have
it might be too much to enter each rule...

The hashlimit might be better if you can use ip addresses instead of
mac addresses.

--
Richard Horton
Users are like a virus: Each causing a thousand tiny crises until the
host finally dies.
http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
http://www.pbase.com/arimus - My online photogallery

-- 
Richard Horton
Users are like a virus: Each causing a thousand tiny crises until the
host finally dies.
http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
http://www.pbase.com/arimus - My online photogallery

Re: rate limit by MAC

[Самусенко Андрей]

Thank you, Richard.
I don't knew about changing MAC on each router.
My question have not sense.
How to fight with IP spoofing? =)

Richard Horton wrote:
> 2009/7/1 Самусенко Андрей <samusenko@msm.ru>:
>   
>> Hi!
>>
>> Can iptables limit rate by MAC? Think it no.
>>
>> What on Linux can do how i need?
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>
>>     
>
> You might be able to...
>
> iptables -A FORWARD -m mac --mac-source <<mac address>> -m limit
> --limit 100/s -j ACCEPT would restrict the given mac address to 100
> packets per second... but depending on how many mac addresses you have
> it might be too much to enter each rule...
>
> The hashlimit might be better if you can use ip addresses instead of
> mac addresses.
>
> --
> Richard Horton
> Users are like a virus: Each causing a thousand tiny crises until the
> host finally dies.
> http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
> http://www.pbase.com/arimus - My online photogallery
>
>   

Re: rate limit by MAC

[Jorge Bastos]

> You might be able to...
>
> iptables -A FORWARD -m mac --mac-source <<mac address>> -m limit
> --limit 100/s -j ACCEPT would restrict the given mac address to 100
> packets per second... but depending on how many mac addresses you have
> it might be too much to enter each rule...

Sawing this thread,
Iptables doesn't (still) have the capacity to do rate limit by itself,
does it?

Jorge,

Re: rate limit by MAC

[Покотиленко Костик]

В Срд, 01/07/2009 в 16:44 +0100, Jorge Bastos пишет:
> > You might be able to...
> >
> > iptables -A FORWARD -m mac --mac-source <<mac address>> -m limit
> > --limit 100/s -j ACCEPT would restrict the given mac address to 100
> > packets per second... but depending on how many mac addresses you have
> > it might be too much to enter each rule...
> 
> Sawing this thread,
> Iptables doesn't (still) have the capacity to do rate limit by itself,
> does it?

Depends on what the "rate" is, packets/time - yes, bytes/time - no.

-- 
Покотиленко Костик <casper@meteor.dp.ua>

Re: rate limit by MAC

[Jorge Bastos]

>> Sawing this thread,
>> Iptables doesn't (still) have the capacity to do rate limit by itself,
>> does it?
>
> Depends on what the "rate" is, packets/time - yes, bytes/time - no.
>
Sorry forgot to specify.
It's bytes.
Oh i see, i use "tc", no problem about it, maybe in the future netfilter
will have this builtin and more simplier than tc/iproute tools.

Jorge,

Re: rate limit by MAC

[Покотиленко Костик]

В Срд, 01/07/2009 в 18:54 +0100, Jorge Bastos пишет:
> >> Sawing this thread,
> >> Iptables doesn't (still) have the capacity to do rate limit by itself,
> >> does it?
> >
> > Depends on what the "rate" is, packets/time - yes, bytes/time - no.
> >
> Sorry forgot to specify.
> It's bytes.
> Oh i see, i use "tc", no problem about it, maybe in the future netfilter
> will have this builtin and more simplier than tc/iproute tools.

That's big question. Those two are too different.

-- 
Покотиленко Костик <casper@meteor.dp.ua>