Kevin Appel schrieb: > Hello everyone, > > I am using the recent module to set up a rule to block too many ssh attempts and I am curious about the last_seen number. Is this some sort of timestamp and if it is, is it possible to translate this to a readable format? > > Example: > [root@caddy net]# cat /proc/net/ipt_recent/sshscans > src=192.168.1.21 ttl: 64 last_seen: 6908449 oldest_pkt: 5 last_pkts: 6866823, 6867384, 6867634, 6908149, 6908449 > > Thank you, > > Kevin I don't know the answer, but looks like sequence numbers to me. But this may bo totally wrong. For what you want to do, this thread may be of interest for you, especially Grant's ideas: https://lists.netfilter.org/pipermail/netfilter/2005-May/060299.html Have a nice time, Joerg
