Why --syn on tcp connlimit?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I have often seen rules such as:

iptables -I FORWARD -p tcp --syn -m iprange --src-range 192.168.1.10-192.168.1.250 -m connlimit --connlimit-above 150 -j DROP

How is this, in effect, different from?:

iptables -I FORWARD -p tcp -m iprange --src-range 192.168.1.10-192.168.1.250 -m connlimit --connlimit-above 150 -j DROP

It's seems at best redundant, and at worst risky. But I am very new at this and must be missing something. :-)

Thanks.

Peter

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux