recent question

recent question

[richard lucassen]

Hello list,

Here are two "recent" rules:

/usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent \
  --update --seconds 60 --hitcount 5 --name smtp -j LOG_REJECT

/usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent --set \
  --name smtp -j ACCEPT

When telnetting for the first time to port 25, the source ip appears in

/proc/net/xt_recent/smtp

So far, so good. But there are 100 entries according to the manpage:

$ wc -l /proc/net/xt_recent/smtp
100

Correct. OTOH, I'm sure that within seconds the 100 entries will be
exceeded, according to the number of connections set up to the smtp
server:

# tcpdump -ni eth0 \
  'dst host 10.1.193.3 and tcp port 25 and tcp[13] == 2'
(outputs a few per second)

And according to /proc/net/ip_conntrack there are more than 100 entries
to 25/tcp.

Where are the entries 101 and higher in /proc/net/xt_recent/smtp?
Are they ignored? Or is the oldest automagically purged?

And when is an entry purged when the --reap is not used? Or does it
behave like a round robin FIFO?

R.

-- 
___________________________________________________________________
It is better to remain silent and be thought a fool, than to speak
aloud and remove all doubt.

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht                                        |
| Public key and email address:                                    |
| http://www.lucassen.org/mail-pubkey.html                         |
+------------------------------------------------------------------+

Re: recent question

[Marco Padovan]

on centos

rmmod xt_recent
modprobe xt_recent ip_list_tot=5000

will increase it to 5000 ;)

(to run rmmod you need to remove the rules using recent before proceeding)

Il 16/07/2012 15:12, richard lucassen ha scritto:
> Hello list,
>
> Here are two "recent" rules:
>
> /usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent \
>   --update --seconds 60 --hitcount 5 --name smtp -j LOG_REJECT
>
> /usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent --set \
>   --name smtp -j ACCEPT
>
> When telnetting for the first time to port 25, the source ip appears in
>
> /proc/net/xt_recent/smtp
>
> So far, so good. But there are 100 entries according to the manpage:
>
> $ wc -l /proc/net/xt_recent/smtp
> 100
>
> Correct. OTOH, I'm sure that within seconds the 100 entries will be
> exceeded, according to the number of connections set up to the smtp
> server:
>
> # tcpdump -ni eth0 \
>   'dst host 10.1.193.3 and tcp port 25 and tcp[13] == 2'
> (outputs a few per second)
>
> And according to /proc/net/ip_conntrack there are more than 100 entries
> to 25/tcp.
>
> Where are the entries 101 and higher in /proc/net/xt_recent/smtp?
> Are they ignored? Or is the oldest automagically purged?
>
> And when is an entry purged when the --reap is not used? Or does it
> behave like a round robin FIFO?
>
> R.
>

Re: recent question

[richard lucassen]

On Mon, 16 Jul 2012 15:25:45 +0200
Marco Padovan <evcz@evcz.tk> wrote:

> on centos
> 
> rmmod xt_recent
> modprobe xt_recent ip_list_tot=5000
> 
> will increase it to 5000 ;)
> 
> (to run rmmod you need to remove the rules using recent before
> proceeding)

Of course, that's in the manpage and in modinfo. But I just wonder what
will happen if you don't increase the modules parameter. I fear Jan
Engelhardt is on holiday ;-)

-- 
___________________________________________________________________
It is better to remain silent and be thought a fool, than to speak
aloud and remove all doubt.

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht                                        |
| Public key and email address:                                    |
| http://www.lucassen.org/mail-pubkey.html                         |
+------------------------------------------------------------------+