ipt_recent: how long does a violater stay in the bad guys list?

ipt_recent: how long does a violater stay in the bad guys list?

[Akhil Sharma]

Question: in ipt_recent, if a client is added to a
hitlist
(/proc/net/ipt_recent/hitlist) after having violated a
rule of sending over 10
packets in a minute, how long is the entry maintained
in the list? Does it ever
get removed from the hitlist? Instead, would it just
track the last time the
packets arrived and never get removed from the hitlist
until the PC is
rebooted?


      

Re: ipt_recent: how long does a violater stay in the bad guys list?

[Jan Engelhardt]

On Thursday 2008-05-22 17:16, Akhil Sharma wrote:

>Question: in ipt_recent, if a client is added to a hitlist 
>(/proc/net/ipt_recent/hitlist) after having violated a rule of sending 
>over 10 packets in a minute, how long is the entry maintained in the 
>list? Does it ever get removed from the hitlist? Instead, would it just 
>track the last time the packets arrived and never get removed from the 
>hitlist until the PC is rebooted?

The list keeps a number of timestamps the client last sent a packet (at 
least it seems so); when a new timestamp is added to the head of the 
list, one gets evicted at the tail if the list has already reached 
its maximum length.
Whether or not a packet subsequently matches the rule depends not on the 
number of timestamp values recorded, but on the parameter you specified 
in your rule (--seconds, etc.).

Re: ipt_recent: how long does a violater stay in the bad guys list?

[Franck JONCOURT]

On Mon, 26 May 2008 14:40:02 +0200 (CEST), Jan Engelhardt

<jengelh@medozas.de> wrote:

> On Thursday 2008-05-22 17:16, Akhil Sharma wrote:

> 

>>Question: in ipt_recent, if a client is added to a hitlist

>>(/proc/net/ipt_recent/hitlist) after having violated a rule of sending

>>over 10 packets in a minute, how long is the entry maintained in the

>>list? Does it ever get removed from the hitlist? Instead, would it just

>>track the last time the packets arrived and never get removed from the

>>hitlist until the PC is rebooted?

> 

> The list keeps a number of timestamps the client last sent a packet (at

> least it seems so); when a new timestamp is added to the head of the

> list, one gets evicted at the tail if the list has already reached

> its maximum length.

> Whether or not a packet subsequently matches the rule depends not on the

> number of timestamp values recorded, but on the parameter you specified

> in your rule (--seconds, etc.).



As a matter of fact, on a local network, you can remove yourself from the

list

by overloading the table with spoof addresses, since by default a table 

remember ip_list_tot=100 ip adresses, and then attempt a new connection

with your own ip :p! It works fine.



---

Franck Joncourt

http://www.debian.org/ - http://smhteam.info/wiki/