On Thursday 2011-10-13 09:10, Michal Kubeček wrote: >On Thursday 13 of October 2011, abirvalg@xxxxxxxxxxx wrote: >> Hi, it seems to me that limit module has issues with timer precision. >> The only iptables rules i have are: >> >> iptables -I OUTPUT 1 -m state --state NEW -m limit --limit 2000/sec >> --limit-burst 1 -j NFQUEUE --queue-num 11220 iptables -I OUTPUT 2 >> -m state --state NEW -j NFQUEUE --queue-num 11222 >> >> iptables -I INPUT 1 -m state --state NEW -m limit --limit 2000/sec >> --limit-burst 1 -j NFQUEUE --queue-num 11221 iptables -I INPUT 2 -m >> state --state NEW -j NFQUEUE --queue-num 11222 >> >> (Both NFQUEUE 11220 and 11221 pass only NF_ACCEPT or NF_DROP >> verdicts.) >> >> If I understand -m limit correctly, only if there is more than 2000 >> NEW connections going in or out, NFQUEUE 11222 will trigger. > >Not exactly. With "--limit-burst 1", no more than one packet per jiffy >can pass the test. You may have only 30 NEW packets per second but it >doesn't mean one packet every 1/30 s. And if there are two (or more) NEW >packets within one jiffy, only the first passes the first rule. One packet per time quantum (which is 1 second here, not 1 jiffy). -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
